Security feed

Node.js 0.5.5 fixes a buffer overflow in the child_process module.

Node.js 0.5.7 includes a fix for a security problem in querystring's hasOwnProperty handling.

Node.js 0.4.12 includes a security-related fix for a hasOwnProperty usage security hole in querystring.

Node.js 0.6.7 includes a V8 hash collision fix and other fixes, including a change to crypto DH initialization error handling.

Node.js 0.6.11 includes a TLS change to mitigate session renegotiation attacks.

Node.js 0.7.5 includes a dgram fix for an out-of-bounds memory read.

Node.js 0.8.4 includes a TLS change to verify the server's identity.

Node.js 0.8.8 fixes uninitialized memory access on Windows, memory corruption in fs-poll.c, and a use-after-free in the stat watcher.

Node.js 0.8.7 includes a fix for uninitialized memory access in OpenSSL.

Node.js 0.8.9 includes a fix to prevent npm from creating world-writable files.

Node.js 0.9.3 includes a fix for HTTPS renegotiation attack protection.

Node.js 0.9.4 includes an HTTP change to protect against response splitting attacks.

Node.js 0.8.20 includes an HTTP fix to protect against response splitting attacks.

Node.js 0.9.11 includes a fix for uninitialized memory access in OpenSSL.

Node.js 0.8.23 includes a TLS change that re-enables CN-ID checking during certificate verification.

Node.js 0.10.5 includes fixes for a NULL pointer dereference and a possible buffer overflow.

Node.js 0.8.26 includes a security fix for the HTTP server implementation; users are urged to upgrade.

Node.js 0.10.21 includes a security fix for the HTTP server implementation; the release recommends upgrading as soon as possible.

Node.js 0.10.29 updates OpenSSL to 1.0.1h, citing CVE-2014-0224.

Node.js 0.8.27 updates OpenSSL to 1.0.0m and includes other fixes.