Skip to content
Heist/ feed
HighFix available

Friday October 13 2023 Security Releases

Type: patchSource: Node.js announcements1 source record

Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x and v20.x Node.js release lines for the following issues.

Node.js

Node.js v20.8.1 (Current)
Affected versions
18.x
This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
20.x
This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
Fixed versions
v20.8.1
Node.js v20.8.1 (Current)
v18.18.2
Node.js v18.18.2 (LTS)
Prerequisites
experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
--experimental-wasm-modules command line option
This vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x.
Related CVEs
CVE-2023-45143
undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)
CVE-2023-44487
nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)
CVE-2023-39331
Permission model improperly protects against path traversal (High) - (CVE-2023-39331)
CVE-2023-39332
Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)
CVE-2023-38552
Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)
CVE-2023-39333
Code injection via WebAssembly export names (Low) - (CVE-2023-39333)

Publisher severity

high

2 high severity issues.
Event
#26545 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement