Security feed

Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.

Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.

Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.

Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.

Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.

Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.

Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.