Skip to content
Heist/ feed
UnratedFix available

November 2018 Security Releases

Type: patchSource: Node.js announcements1 source record

Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement (below).

Node.js 11

Node.js 11.3.0 (Current)
Affected versions
All versions of Node.js 11
All versions of Node.js 11 (Current) are vulnerable
Fixed versions
11.3.0
Node.js 11.3.0 (Current)
Prerequisites
Not stated in this extraction

Node.js 10

Node.js 10.14.0 (LTS "Dubnium")
Affected versions
All versions of Node.js 10
All versions of Node.js 10 (LTS "Dubnium") are vulnerable
Fixed versions
10.14.0
Node.js 10.14.0 (LTS "Dubnium")
Prerequisites
Not stated in this extraction

Node.js 8

Node.js 8.14.0 (LTS "Carbon")
Affected versions
All versions of Node.js 8
All versions of Node.js 8 (LTS "Carbon") are vulnerable
Fixed versions
8.14.0
Node.js 8.14.0 (LTS "Carbon")
Prerequisites
Not stated in this extraction

Node.js 6

Node.js 6.15.0 (LTS "Boron")
Affected versions
All versions of Node.js 6
All versions of Node.js 6 (LTS "Boron") are vulnerable
Fixed versions
6.15.0
Node.js 6.15.0 (LTS "Boron")
6.15.1
Node.js 6.15.1 (LTS "Boron") was released to fix a misapplied backport
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2018-12120
Debugger port 5858 listens on any interface by default (CVE-2018-12120)
CVE-2018-12121
Denial of Service with large HTTP headers (CVE-2018-12121)
CVE-2018-12122
"Slowloris" HTTP Denial of Service (CVE-2018-12122)
CVE-2018-12123
Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
CVE-2018-12116
HTTP request splitting (CVE-2018-12116)
CVE-2018-0735
OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)
CVE-2018-0734
OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)
CVE-2018-5407
OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

Publisher severity

No explicit severity was extracted.

Event
#51926 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement