Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js Security Releases — April 3, 2024

Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.

Announced

Node.js · Fixed in 18.x, 20.x, 21.xllhttp · Fixed in 9.2.1undici · Fixed in 6.11.1, 5.28.4CVE-2024-27983CVE-2024-27982
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.

Node.js

The Node.js Project
Affected versions
18.x
The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
20.x
The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
21.x
The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
Fixed versions
18.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
20.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
21.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
Prerequisites
Not stated in this extraction

llhttp

llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Affected versions
Not stated in this extraction
Fixed versions
9.2.1
llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Prerequisites
Not stated in this extraction

undici

undici version 6.11.1 on 21.x
Affected versions
Not stated in this extraction
Fixed versions
6.11.1
undici version 6.11.1 on 21.x
5.28.4
undici version 5.28.4 on 18.x and 20.x
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2024-27983
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983)
CVE-2024-27982
HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982)

Publisher severity

No explicit severity was extracted.

Event
#24633 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement