OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.
Node.js
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
Affected versions
v8.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
v10.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
v12.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction
OpenSSL
The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
Affected versions
Not stated in this extraction
Fixed versions
1.0.2t
The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
1.1.1d
The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
Node.js security releases update npm to address vulnerabilities involving global binary overwrites, symlinks outside node_modules, and arbitrary file writes. The announcement says all current release lines were affected.
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Vulnerabilities fixed: CVE-2019-15606: HTTP header values do not have trailing OWS trimmed. CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header. CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.
Node.js
Node.js 12.15.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.15.0
Node.js 12.15.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-15606
CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
CVE-2019-15605
CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
CVE-2019-15604
CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.
Node.js 10.19.0 is a security release fixing three vulnerabilities and tightening HTTP parsing. The release notes warn that the insecure HTTP parser should be avoided.
Node.js 13.8.0 is a security release fixing three listed vulnerabilities and tightening HTTP parsing; the release notes describe an option to disable strict checks but advise against using it.
Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.
The OpenSSL 1.1.1g issue does not affect Node.js because the affected function is not called by Node.js or its dependencies; no Node.js security releases are required.
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
It only affects a function which is not called by Node.js (or its dependencies), and as such, does not affect Node.js. No Node.js security releases are required.
Node.js released security updates for supported release lines addressing TLS session reuse, HTTP/2 settings-frame denial of service, N-API string-buffer memory corruption, and an ICU issue. Node.js 10.21.0, 12.18.0, and 14.4.0 are the listed releases.
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for all supported Node.js release lines for the following issues.
Node.js
Node.js v10.21.0 (LTS)
Affected versions
10.x
Affects Node.js 10.x, 12.x, and 14.x.
12.x
Affects Node.js 12.x, and 14.x.
14.x
Affects Node.js 12.x, and 14.x.
Fixed versions
10.21.0
Node.js v10.21.0 (LTS)
12.18.0
Node.js v12.18.0 (LTS)
14.4.0
Node.js v14.4.0 (Current)
Prerequisites
Not stated in this extraction
node-addon-api
https://www.npmjs.com/package/node-addon-api
Affected versions
1.x
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
2.x
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
Fixed versions
Not stated in this extraction
Prerequisites
when a native add-on is/was built using a version of Node.js that did not support N-API internally
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
Related CVEs
CVE-2020-8172
TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)
CVE-2020-11080
HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)
CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)
CVE-2020-10531
ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
Node.js
Node.js 14.4.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
14.4.0
Node.js 14.4.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8172
CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass
CVE-2020-11080
CVE-2020-11080: HTTP/2 Large Settings Frame DoS
CVE-2020-8174
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption
Node.js 12.18.0 (LTS) is a security release that fixes three vulnerabilities, including TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption issues.
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
Node.js
Node.js 12.18.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.18.0
Node.js 12.18.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8172
CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
CVE-2020-11080
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
CVE-2020-8174
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Vulnerabilities fixed: CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical). CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).
Node.js
Node.js 14.11.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
14.11.0
Node.js 14.11.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8251
CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical).
CVE-2020-8201
CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).
