Skip to content

v0.14.36

Choose a tag to compare

View all tags
@icebob-ai icebob-ai released this 29 Aug 20:25
· 422 commits to master since this release
v0.14.36
426e89a

Security

  • fix(tcp): unauthenticated Denial of Service in the TCP transporter packet parser (GHSA-h89v-g948-47vp, CWE-835, CVSS 3.1 7.5 High). A crafted packet with a negative length field caused an infinite synchronous loop in Parser._write, blocking the event loop of any node using the TCP transporter — reachable without authentication by a single 10-byte TCP packet. The parser now rejects packets whose length field is smaller than the header size. The 0.15.x line received the same fix in 0.15.2.

Changes

  • ci: remove unbuildable native dev dependencies (@icebob/node-memwatch, gc-stats, event-loop-stats) and the optional leak-detection suite; replace retired Bitnami Docker images in the E2E test setup

Published to npm under the maintenance dist-tag: npm install moleculer@0.14.36

Assets 2
Loading