Skip to content
Heist/ feed
HighFix available

Node.js 6.7.0 (Current)

Type: patchSource: Node.js announcements1 source record

Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.

Announced Group revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 6.7.0 (Current) This is an important security release.

Node.js

Node.js 6.7.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
6.7.0
Node.js 6.7.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2016-6304
CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity)
CVE-2016-2183
CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306.
CVE-2016-2178
CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306.
CVE-2016-6306
CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306.
CVE-2016-7052
Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052.
CVE-2016-5325
http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector.
CVE-2016-7099
tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string.

Publisher severity

high

CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity)
Event
#62294 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. nodejs · Revision 1Source updated