Security feed

Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.

Node.js 4.3.0 is an important security release. It changes HTTP header parsing to address request smuggling and response splitting, and updates OpenSSL and http-parser.

Node.js released security updates for four release lines, including fixes for announced vulnerabilities and OpenSSL updates. The v4.2.x line is no longer updated; users are advised to upgrade.

Node.js 4.3.2 upgrades OpenSSL to 1.0.2g, fixing defects associated with denial of service or memory corruption, and the CacheBleed side-channel attack.

Node.js 5.7.1 upgrades OpenSSL to 1.0.2g and includes fixes for defects associated with three CVEs. The announcement describes the issues as low severity for Node.js users or unlikely to enable practical attacks in No…

Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.

Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.

Node.js 0.12.12 removes SSLv2 support and makes the --enable-ssl2 argument produce an error, addressing the risk associated with SSLv2 being enabled.

Node.js 5.9.0 fixes a memory consumption issue associated with heavy use of vm.createContext and vm.runInNewContext.

Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.

Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.

Node.js 5.11.1 includes a buffer safeguard and upgrades its OpenSSL sources to 1.0.2h.

Node.js 4.4.4 updates OpenSSL to 1.0.2h and refers readers to a blog post for security details.

Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.

Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().

Node.js 4.4.6 is an important security release related to a V8 Buffer overflow vulnerability.

Node.js security releases are listed, with users directed to a separate summary for details on patched vulnerabilities.

Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.

Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.

Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.