Security feed

io.js 1.3.0 changes the default TLS and HTTPS cipher suite to provide Perfect Forward Secrecy with modern browsers and excludes insecure RC4 ciphers.

io.js 1.4.1 updates V8 to 4.1.0.21, including an embargoed fix, and updates libuv to 1.4.2. The announcement does not identify the security issue or provide severity details.

io.js 1.5.1 reports resolving a TLS memory leak, though testing indicated some leak problems may remain.

io.js 1.6.4 upgrades npm to 2.7.5, which includes two important security fixes.

io.js 2.1.0 requires Diffie-Hellman parameters to be at least 1024 bits and is reported to fix the Logjam vulnerability.

io.js released versions 1.8.3 and 2.3.3 to fix an out-of-band write in the utf8 decoder that could cause denial of service. The announcement also describes an OpenSSL upgrade in 1.8.3.

io.js v3.3.1 updates npm to version 2.14.3, which the announcement describes as including a security update. The announcement does not identify a specific vulnerability or affected versions.