Heist/ feed

Security feed

patchHighFix availableNode.js announcements

Friday October 13 2023 Security Releases

Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.

Announced

Node.js · Fixed in v20.8.1, v18.18.2CVE-2023-45143CVE-2023-44487CVE-2023-39331CVE-2023-39332CVE-2023-38552CVE-2023-39333
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x and v20.x Node.js release lines for the following issues.

Node.js

Node.js v20.8.1 (Current)
Affected versions
18.x
This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
20.x
This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
Fixed versions
v20.8.1
Node.js v20.8.1 (Current)
v18.18.2
Node.js v18.18.2 (LTS)
Prerequisites
experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
--experimental-wasm-modules command line option
This vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x.
Related CVEs
CVE-2023-45143
undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)
CVE-2023-44487
nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)
CVE-2023-39331
Permission model improperly protects against path traversal (High) - (CVE-2023-39331)
CVE-2023-39332
Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)
CVE-2023-38552
Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)
CVE-2023-39333
Code injection via WebAssembly export names (Low) - (CVE-2023-39333)

Publisher severity

high

2 high severity issues.
Event
#26545 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 20.8.1 (Current)

Node.js 20.8.1 fixes multiple security vulnerabilities, including issues involving nghttp2, undici, path traversal, policy integrity checks, and WebAssembly export names.

Announced

Node.js · Fixed in 20.8.1CVE-2023-44487CVE-2023-45143CVE-2023-39332CVE-2023-39331CVE-2023-38552CVE-2023-39333
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.8.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
20.8.1
Node.js 20.8.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2023-44487
CVE-2023-44487: nghttp2 Security Release (High)
CVE-2023-45143
CVE-2023-45143: undici Security Release (High)
CVE-2023-39332
CVE-2023-39332: Path traversal through path stored in Uint8Array (High)
CVE-2023-39331
CVE-2023-39331: Permission model improperly protects against path traversal (High)
CVE-2023-38552
CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)
CVE-2023-39333
CVE-2023-39333: Code injection via WebAssembly export names (Low)

Publisher severity

No explicit severity was extracted.

Event
#26544 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement