Releases: nodejs/node
2022-11-04, Version 14.21.1 'Fermium' (LTS), @BethGriggs
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.
Commits
- [
2b433af094
] - inspector: harden IP address validation again (Tobias NieΓen) nodejs-private/node-private#354
2022-11-01, Version 14.21.0 'Fermium' (LTS), @danielleadams
Notable changes
- deps:
- update corepack to 0.14.2 (Node.js GitHub Bot) #44775
- src:
- add --openssl-shared-config option (Daniel Bevenius) #43124
Commits
- [
773f587912
] - deps: cherry-pick libuv/libuv@3a7b955 (Ben Noordhuis) #43950 - [
a1dea66956
] - deps: cherry-pick libuv/libuv@abb109f (Ben Noordhuis) #43950 - [
98c49d81f5
] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775 - [
18c43c8518
] - deps: update timezone to tz2022e (Richard Lau) #45094 - [
a1f8e4db48
] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704 - [
e55389ca86
] - deps: update corepack to 0.14.0 (Node.js GitHub Bot) #44509 - [
0227462418
] - deps: update corepack to 0.13.0 (Node.js GitHub Bot) #44318 - [
ee24c320ea
] - deps: update corepack to 0.12.3 (Node.js GitHub Bot) #44229 - [
28e9891449
] - deps: update corepack to 0.12.2 (Node.js GitHub Bot) #44159 - [
b6972c9df2
] - deps: update corepack to 0.12.1 (Node.js GitHub Bot) #43965 - [
9d6cb3b5f1
] - deps: update corepack to 0.12.0 (Node.js GitHub Bot) #43748 - [
fa6c276b4f
] - deps: update Corepack to 0.11.2 (MaΓ«l Nison) #43402 - [
4f83d75626
] - (SEMVER-MAJOR) src,doc,test: add --openssl-shared-config option (Daniel Bevenius) #43124 - [
9487028043
] - test: fix intl tests on small-icu builds (Antoine du Hamel) #41939 - [
a1d52097f8
] - tools: add more options to track flaky tests (Antoine du Hamel) #43954
2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @ruyadorno and @RafaelGSS
Notable Changes
This release marks the transition of Node.js 18.x into Long Term Support (LTS)
with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS"
and will remain so until October 2023. After that time, it will move into
"Maintenance" until end of life in April 2025.
2022-10-18, Version 19.0.0 (Current), @RafaelGSS and @ruyadorno
Node.js 19 is here! Highlights include the update of the V8 JavaScript engine to 10.7, HTTP(s)/1.1 KeepAlive enabled by default, and ESM Resolution adjustments.
Node.js 19 will replace Node.js 18 as our βCurrentβ release line when Node.js 18 enters long-term support (LTS) later this month.
As per the release schedule, Node.js 19 will be βCurrent' release for the next 6 months, until April 2023.
Notable Changes
Deprecations and Removals
- [
7dd2f41c73
] - (SEMVER-MAJOR) module: runtime deprecate exports double slash maps (Guy Bedford) #44495 - [
ada2d053ae
] - (SEMVER-MAJOR) process: runtime deprecate coercion to integer inprocess.exit()
(Daeyeon Jeong) #44711
HTTP(S)/1.1 KeepAlive by default
Starting with this release, Node.js sets keepAlive
to true by default. This means that any outgoing HTTP(s) connection will automatically use HTTP 1.1 Keep-Alive. The default waiting window is 5 seconds.
Enable keep-alive will deliver better throughput as connections are reused by default.
Additionally, the agent is now able to parse the response Keep-Alive
which the servers might send. This header instructs the client on how much to stay connected.
On the other side, the Node.js HTTP server will now automatically disconnect idle clients (which are using HTTP Keep-Alive to reuse the connection) when close()
is invoked).
Node.js HTTP(S)/1.1 requests may experience a better throughput/performance by default.
Contributed by Paolo Insogna in #43522
DTrace/SystemTap/ETW Support were removed
The main reason is the lack of resources from the Node.js team. The complexity to keep the support up-to-date has proved not worth it without a clear plan to support those tools. Hence, an issue was raised in the Node.js repository to assess better support, for DTrace
in specific.
Contributed by Ben Noordhuis in #43651 and #43652
V8 10.7
The V8 engine is updated to version 10.7, which is part of Chromium 107.
This version include a new feature to the JavaScript API: Intl.NumberFormat
.
Intl.NumberFormat
v3 API is a new TC39 ECMA402 stage 3 proposal
extend the pre-existing Intl.NumberFormat
.
The V8 update was a contribution by MichaΓ«l Zasso in #44741.
llhttp 8.1.0
llhttp has been updated to version 8.1.0. Collectively, this version brings many updates to the llhttp API, introducing new callbacks and allow all callback to be pausable.
Contributed by Paolo Insogna in #44967
Other Notable Changes
- [
46a3afb579
] - doc: graduate webcrypto to stable (Filip Skokan) #44897 - [
f594cc85b7
] - esm: remove specifier resolution flag (Geoffrey Booth) #44859
Semver-Major Commits
- [
53f73d1cfe
] - (SEMVER-MAJOR) build: enable V8's trap handler on Windows (MichaΓ«l Zasso) #44741 - [
06aaf8a1c4
] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (MichaΓ«l Zasso) #44741 - [
aa3a572e6b
] - (SEMVER-MAJOR) build: remove dtrace & etw support (Ben Noordhuis) #43652 - [
38f1e2793c
] - (SEMVER-MAJOR) build: remove systemtap support (Ben Noordhuis) #43651 - [
2849283c4c
] - (SEMVER-MAJOR) crypto: remove non-standardwebcrypto.Crypto.prototype.CryptoKey
(Antoine du Hamel) #42083 - [
a1653ac715
] - (SEMVER-MAJOR) crypto: do not allow to call setFips from the worker thread (Sergey Petushkov) #43624 - [
fd36a8dadb
] - (SEMVER-MAJOR) deps: update llhttp to 8.1.0 (Paolo Insogna) #44967 - [
89ecdddaab
] - (SEMVER-MAJOR) deps: bump minimum ICU version to 71 (MichaΓ«l Zasso) #44741 - [
66fe446efd
] - (SEMVER-MAJOR) deps: V8: cherry-pick 0cccb6f27d78 (MichaΓ«l Zasso) #44741 - [
88ed027d57
] - (SEMVER-MAJOR) deps: V8: cherry-pick 7ddb8399f9f1 (MichaΓ«l Zasso) #44741 - [
26c651c34e
] - (SEMVER-MAJOR) deps: V8: cherry-pick 1b3a4f0c34a1 (MichaΓ«l Zasso) #44741 - [
c8ff2dfd11
] - (SEMVER-MAJOR) deps: V8: cherry-pick b161a0823165 (MichaΓ«l Zasso) #44741 - [
7a8fa2d517
] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (MichaΓ«l Zasso) #44741 - [
83b0aaa800
] - (SEMVER-MAJOR) deps: fix V8 build on SmartOS (MichaΓ«l Zasso) #44741 - [
7a952e8ea5
] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (MichaΓ«l Zasso) #44741 - [
6bd756d7c6
] - (SEMVER-MAJOR) deps: update V8 to 10.7.193.13 (MichaΓ«l Zasso) #44741 - [
03fb789fb9
] - (SEMVER-MAJOR) events: add null check for the signal of EventTarget (Masashi Hirano) #43153 - [
a4fa526ddc
] - (SEMVER-MAJOR) fs: add directory autodetection to fsPromises.symlink() (Livia Medeiros) #42894 - [
bb4891d8d4
] - (SEMVER-MAJOR) fs: add validateBuffer to improve error (Hirotaka Tagawa / wafuwafu13) #44769 - [
950a4411fa
] - (SEMVER-MAJOR) fs: remove coercion to string in writing methods (Livia Medeiros) #42796 - [
41a6d82968
] - (SEMVER-MAJOR) fs: harden fs.readSync(buffer, options) typecheck (LiviaMedeiros) #42772 - [
2275faac2b
] - (SEMVER-MAJOR) fs: harden fs.read(params, callback) typecheck (LiviaMedeiros) #42772 - [
29953a0b88
] - (SEMVER-MAJOR) fs: harden filehandle.read(params) typecheck (LiviaMedeiros) #42772 - [
4267b92604
] - (SEMVER-MAJOR) http: use Keep-Alive by default in global agents (Paolo Insogna) #43522 - [
0324529e0f
] - (SEMVER-MAJOR) inspector: introduce inspector/promises API (Erick Wendel) #44250 - [
80270994d6
] - (SEMVER-MAJOR) lib: enable global CustomEvent by default (Daeyeon Jeong) #44860 - [
f529f73bd7
] - (SEMVER-MAJOR) lib: brand check event handler property receivers (Chengzhong Wu) #44483 - [
6de2673a9f
] - (SEMVER-MAJOR) lib: enable global WebCrypto by default (Antoine du Hamel) #42083 - [
73ba8830d5
] - (SEMVER-MAJOR) lib: use private field in AbortController (Joyee Cheung) #43820 - [
7dd2f41c73
] - (SEMVER-MAJOR) module: runtime deprecate exports double slash maps (Guy Bedford) #44495 - [
22c39b1ddd
] - (SEMVER-MAJOR) path: the dot will be added(path.format) if it is not specified inext
(theanarkh) #44349 - [
587367d107
] - **(SEMVER-MA...
2022-10-13, Version 18.11.0 (Current), @danielleadams
Notable changes
watch mode (experimental)
Running in 'watch' mode using node --watch
restarts the process when an imported file is changed.
Contributed by Moshe Atlow in #44366
Other notable changes
- fs:
- (SEMVER-MINOR) add
FileHandle.prototype.readLines
(Antoine du Hamel) #42590
- (SEMVER-MINOR) add
- http:
- (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #44180
- http2:
- (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #44820
- lib:
- (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #44048
- src:
- (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #44121
- util:
- (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #44631
Commits
- [
27b4b782ce
] - benchmark: add vm context global proxy benchmark (Joyee Cheung) #44796 - [
4e82521af1
] - bootstrap: update comments in bootstrap/node.js (Joyee Cheung) #44726 - [
725be0ea50
] - buffer: initialize TextDecoder once on blob.text() (Yagiz Nizipli) #44787 - [
653c3b1f62
] - buffer,lib: update atob to align wpt's base64.json (Khaidi Chu) #43901 - [
37808b3355
] - build: convert V8 test JSON to JUnit XML (Keyhan Vakil) #44049 - [
f92871a52b
] - build: update timezone-update.yml (Alex) #44717 - [
f85d3471ee
] - child_process: remove lookup of undefined property (Colin Ihrig) #44766 - [
2f5f41c315
] - (SEMVER-MINOR) cli: add--watch
(Moshe Atlow) #44366 - [
7fb9cc70f3
] - cluster: use inspector utils (Moshe Atlow) #44592 - [
99a2c16040
] - crypto: add causes to applicable webcrypto's OperationError (Filip Skokan) #44890 - [
e0fbba0939
] - crypto: use EVP_PKEY_CTX_set_dsa_paramgen_q_bits when available (David Benjamin) #44561 - [
a90386b0a1
] - deps: update undici to 5.11.0 (Node.js GitHub Bot) #44929 - [
aa68d40fbf
] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775 - [
c892f35815
] - deps: V8: fix debug build (Ben Noordhuis) #44392 - [
91514393dc
] - dns: support dns module in the snapshot (Joyee Cheung) #44633 - [
ce3cb29319
] - doc: add fsPromises.readFile() example (Tierney Cyren) #40237 - [
97df9b84a2
] - doc: improve building doc for Android (BuShe Pie) #44888 - [
8c69da893b
] - doc: mentioncorepack prepare
supports tag or range (Michael Rienstra) #44646 - [
842bc64833
] - doc: remove Legacy status from querystring (Rich Trott) #44912 - [
ddb5402f5f
] - doc: fix label name in collaborator guide (Rich Trott) #44920 - [
d08b024a3d
] - doc: fix typo in Node.js 12 changelog (Lorand Horvath) #42880 - [
b6b9c427c5
] - doc: move release keys we don't use anymore in README (Rich Trott) #44899 - [
e92b074b32
] - doc: fix grammar in dns docs (#44850) (Colin Ihrig) #44850 - [
780144c339
] - doc: remove unnecessary leading commas (Colin Ihrig) #44854 - [
6ae9bc8fbc
] - doc: add extra step for reporter pre-approval (Rafael Gonzaga) #44806 - [
ccf31d8bca
] - doc: add anchor link for --preserve-symlinks (Kohei Ueno) #44858 - [
7c5c19ee54
] - doc: update node prefix require.cache example (Simone Busoli) #44724 - [
2a5bce6318
] - doc: include last security release date (Vladimir de Turckheim) #44794 - [
4efaf4265c
] - doc: remove "currently" and comma splice from child_process.md (Rich Trott) #44789 - [
3627616b40
] - doc,crypto: mark experimental algorithms more visually (Filip Skokan) #44892 - [
3c653cf23a
] - doc,crypto: add missing CFRG curve algorithms to supported lists (Filip Skokan) #44876 - [
70f55020d3
] - doc,crypto: add null length to crypto.subtle.deriveBits (Filip Skokan) #44876 - [
910fbd0ece
] - esm: fix duplicated test (Geoffrey Booth) #44779 - [
bc00f3bde1
] - fs: fix opts.filter issue in cp async (Tho) #44922 - [
11d1c23fa0
] - (SEMVER-MINOR) fs: addFileHandle.prototype.readLines
(Antoine du Hamel) #42590 - [
67fb76519a
] - fs: improve promise based readFile performance for big files (Ruben Bridgewater) #44295 - [
dc6379bdc2
] - fs: don't hard code name in validatePosition() (Colin Ihrig) #44767 - [
eb19b1e97c
] - http: be more aggressive to reply 400, 408 and 431 (ywave620) #44818 - [
4c869c8d9e
] - (SEMVER-MINOR) http: add writeEarlyHints function to ServerResponse (Wing) #44180 - [
9c7e66478c
] - (SEMVER-MINOR) http2: make early hints generic (Yagiz Nizipli) #44820 - [
3f20e5b15c
] - (SEMVER-MINOR) lib: refactor transferable AbortSignal (flakey5) #44048 - [
ada7d82b16
] - lib: require JSDoc in internal validators code (Rich Trott) #44896 - [
67eaa303af
] - lib: add cause to DOMException (flakey5) #44703 - [
0db86ee98e
] - meta: update AUTHORS (Node.js GitHub Bot) #44930 - [
2efe4d985b
] - meta: label test.js and test.md with test_runner label (Moshe Atlow) #44863 - [
fd9feb3a6c
] - meta: update AUTHORS (Node.js GitHub Bot) #44857 - [
a854bb39c9
] - node-api: create reference only when needed (Gerhard StΓΆbich) [#44827](https://github.com/no...
2022-10-12, Version 16.18.0 'Gallium' (LTS), @juanarbol
Notable changes
- [
1cc050eaa8
] - (SEMVER-MINOR) assert: addgetCalls
andreset
to callTracker (Moshe Atlow) #44191 - [
e5c9975f11
] - (SEMVER-MINOR) crypto: allow zero-length secret KeyObject (Filip Skokan) #44201 - [
317cd051ce
] - (SEMVER-MINOR) crypto: allow zero-length IKM in HKDF and in webcrypto PBKDF2 (Filip Skokan) #44201 - [
f80bdc5ef3
] - (SEMVER-MINOR) doc: deprecate modp1, modp2, and modp5 groups (Tobias NieΓen) #44588 - [
8398e98b1b
] - (SEMVER-MINOR) http: make idle http parser count configurable (theanarkh) #43974 - [
2cd2f56962
] - (SEMVER-MINOR) http: throw error on content-length mismatch (sidwebworks) #44378 - [
6be761e8a9
] - (SEMVER-MINOR) lib: add diagnostics channel for process and worker (theanarkh) #44045 - [
1400796cef
] - (SEMVER-MINOR) net,tls: pass a valid socket ontlsClientError
(Daeyeon Jeong) #44021 - [
092239a7f1
] - (SEMVER-MINOR) net: add local family (theanarkh) #43975 - [
381e11e18e
] - (SEMVER-MINOR) report: expose report public native apis (Chengzhong Wu) #44255 - [
2ba547aa5b
] - (SEMVER-MINOR) src: expose environment RequestInterrupt api (Chengzhong Wu) #44362 - [
6ed3367155
] - (SEMVER-MINOR) stream: addReadableByteStream.tee()
(Daeyeon Jeong) #44505 - [
0fbedac6ce
] - (SEMVER-MINOR) test_runner: add before/after/each hooks (Moshe Atlow) #43730 - [
70563b53c5
] - (SEMVER-MINOR) util: addmaxArrayLength
option to Set and Map (Kohei Ueno) #43576
Commits
- [
1cc050eaa8
] - (SEMVER-MINOR) assert: addgetCalls
andreset
to callTracker (Moshe Atlow) #44191 - [
2e87cdd1e6
] - benchmark: fix startup benchmark (Evan Lucas) #44727 - [
29c0f9ef30
] - benchmark: add stream destroy benchmark (SindreXie) #44533 - [
f01bb58c1e
] - bootstrap: update comments in bootstrap/node.js (Joyee Cheung) #44726 - [
db151e182f
] - bootstrap: stop delaying instantiation of maps in per-context scripts (Darshan Sen) #42934 - [
f700074c57
] - buffer: fixatob
input validation (Austin Kelleher) #42662 - [
e10095a759
] - build: update timezone-update.yml (Alex) #44717 - [
bec2ede687
] - build: remove redundant entry in crypto (Jiawen Geng) #44604 - [
7b3a2c3353
] - build: rewritten the Android build system (BuShe Pie) #44207 - [
e96bb14942
] - build: add --libdir flag to configure (Stephen Gallagher) #44361 - [
2a4491b34d
] - build: added NINJA env to customize ninja binary (Jeff Dickey) #44293 - [
aaad7a64b4
] - build: enable pointer authentication for branch protection on arm64 (Jeremiah Gowdy) #43200 - [
041bb54143
] - build: add workflow to label flaky-test platform (Rafael Gonzaga) #44042 - [
58d85c1109
] - build: optimized and fixed building configuration to Android (BuShe) #44016 - [
5cd8b7bc8b
] - build: allow test-internet on forks if not scheduled (Rich Trott) #44073 - [
9698be9347
] - build: skip test-internet run on forks (Rich Trott) #44054 - [
25e6f48e4a
] - child_process: remove lookup of undefined property (Colin Ihrig) #44766 - [
a3bdd07321
] - cluster: fix cluster rr distribute error (theanarkh) #44202 - [
317cd051ce
] - (SEMVER-MINOR) crypto: allow zero-length IKM in HKDF and in webcrypto PBKDF2 (Filip Skokan) #44201 - [
e5c9975f11
] - (SEMVER-MINOR) crypto: allow zero-length secret KeyObject (Filip Skokan) #44201 - [
7e705d8d74
] - crypto: fix webcrypto deriveBits validations (Filip Skokan) #44173 - [
7ad2a268b9
] - crypto: fix webcrypto EC key namedCurve validation errors (Filip Skokan) #44172 - [
2c938d73ff
] - crypto: fix webcrypto operation errors to be OperationError (Filip Skokan) #44171 - [
a6e2cb40a6
] - crypto: fix webcrypto generateKey() AES key length validation error (Filip Skokan) #44170 - [
7e07cce24b
] - crypto: use EVP_PKEY_CTX_set_dsa_paramgen_q_bits when available (David Benjamin) #44561 - [
1fc6394741
] - crypto: restrict PBKDF2 args to signed int (Tobias NieΓen) #44575 - [
9a52ee7577
] - crypto: handle invalid prepareAsymmetricKey JWK inputs (Filip Skokan) #44475 - [
7100baee40
] - crypto: use actual option name in error message (Tobias NieΓen) #44455 - [
579e066c3a
] - crypto: add digest name to INVALID_DIGEST errors (Tobias NieΓen) #44468 - [
566d80f622
] - crypto: improve RSA-PSS digest error messages (Tobias NieΓen) #44307 - [
f717c1e06a
] - debugger: decrease timeout used to wait for the port to be free (Joyee Cheung) #44359 - [
0f2fcaf771
] - deps: update to ngtcp2 0.8.1 and nghttp3 0.7.0 (Tobias NieΓen) #44622 - [
1a8aada69d
] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704 - [
e4f18b4f34
] - deps: update ngtcp2 update instructions (Tobias NieΓen) #44619 - [
21b5ab1494
] - deps: upgrade npm to 8.19.2 (npm team) #44632 - [
916b319e7a
] - deps: update to uvwasi 0.0.13 (Colin Ihrig) #44524 - [
67cbbcc902
] - deps: update cor...
2022-09-28, Version 18.10.0 (Current), @RafaelGSS
Notable changes
- doc:
- gyp:
- libnode for ios app embedding (chexiongsheng) #44210
- http:
- (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #44588
- stream:
- (SEMVER-MINOR) add
ReadableByteStream.tee()
(Daeyeon Jeong) #44505
- (SEMVER-MINOR) add
Commits
- [
f497368679
] - benchmark: fix startup benchmark (Evan Lucas) #44727 - [
0c9a94684e
] - benchmark: add stream destroy benchmark (SindreXie) #44533 - [
9c5c1459a8
] - bootstrap: clean up inspector console methods during serialization (Joyee Cheung) #44279 - [
19f67dba8a
] - bootstrap: remove unused global parameter in per-context scripts (Joyee Cheung) #44472 - [
9da11426f6
] - build: remove redundant entry in crypto (Jiawen Geng) #44604 - [
70898b4e67
] - build: rewritten the Android build system (BuShe Pie) #44207 - [
a733f7faac
] - Revert "build: go faster, drop -fno-omit-frame-pointer" (Ben Noordhuis) #44566 - [
1315a83333
] - build: fix bad upstream merge (Stephen Gallagher) #44642 - [
993bd9b134
] - crypto: restrict PBKDF2 args to signed int (Tobias NieΓen) #44575 - [
ca5fb67b4e
] - deps: update to ngtcp2 0.8.1 and nghttp3 0.7.0 (Tobias NieΓen) #44622 - [
8da1d6ebc4
] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704 - [
d36c4a3088
] - deps: update ngtcp2 update instructions (Tobias NieΓen) #44619 - [
7129106aa0
] - deps: upgrade npm to 8.19.2 (npm team) #44632 - [
3cc8f4bb56
] - deps: update to uvwasi 0.0.13 (Colin Ihrig) #44524 - [
4686579d4b
] - dns: remove unnecessary parameter from validateOneOf (Yagiz Nizipli) #44635 - [
729dd95f1f
] - dns: refactor default resolver (Joyee Cheung) #44541 - [
6dc038262a
] - doc: mention git node backport (RafaelGSS) #44764 - [
fd971f5176
] - doc: ensure to revert node_version changes (Rafael Gonzaga) #44760 - [
f274b08f8e
] - doc: fix description fornapi_get_cb_info()
inn-api.md
(Daeyeon Jeong) #44761 - [
2502f2353d
] - doc: update the deprecation for exit code to clarify its scope (Daeyeon Jeong) #44714 - [
064543d0ae
] - doc: update guidance for adding new modules (Michael Dawson) #44576 - [
33a2f17534
] - doc: add registry number for Electron 22 (Keeley Hammond) #44748 - [
10a0d75c26
] - doc: include code examples for webstreams consumers (Lucas Santos) #44387 - [
4dbe4a010c
] - doc: mention where to push security commits (RafaelGSS) #44691 - [
82cb8151ad
] - doc: remove extra space on threadpool usage (Connor Burton) #44734 - [
6ef9af2748
] - doc: make legacy banner slightly less bright (Rich Trott) #44665 - [
b209c83e66
] - doc: improve building doc for Windows Powershell (Brian Muenzenmeyer) #44625 - [
05b17e9250
] - doc: maintain only one list of MODP groups (Tobias NieΓen) #44644 - [
ec1cbdb69b
] - doc: add legendecas to TSC list (Michael Dawson) #44662 - [
9341fb4446
] - doc: remove comma in README.md (Taha-Chaudhry) #44599 - [
3dabb44dda
] - doc: use serial comma in report docs (Daeyeon Jeong) #44608 - [
226d90a95a
] - doc: use serial comma in stream docs (Daeyeon Jeong) #44609 - [
3f710fa636
] - doc: remove empty line in YAML block (Claudio Wunder) #44617 - [
4ad1b0abc3
] - (SEMVER-MINOR) doc: deprecate modp1, modp2, and modp5 groups (Tobias NieΓen) #44588 - [
2d92610525
] - doc: remove old OpenSSL ENGINE constants (Tobias NieΓen) #44589 - [
03705639c4
] - doc: fix heading levels for test runner hooks (Fabian Meyer) #44603 - [
6c557346a7
] - doc: fix errors in http.md (Luigi Pinca) #44587 - [
48d944b71c
] - doc: fix vm.Script createCachedData example (Chengzhong Wu) #44487 - [
2813323120
] - doc: mention how to get commit release (Rafael Gonzaga) #44572 - [
ea7b44d474
] - doc: fix link inprocess.md
(Antoine du Hamel) #44594 - [
39b65d2fb7
] - doc: do not use weak MODP group in example (Tobias NieΓen) #44585 - [
f5549afd90
] - doc: remove ebpf from supported tooling list (Rafael Gonzaga) #44549 - [
a3360b1f4f
] - doc: emphasize that createCipher is never secure (Tobias NieΓen) #44538 - [
4e6f7862ba
] - doc: document attribute Script.cachedDataRejected (Chengzhong Wu) #44451 - [
01e584ecab
] - doc: move policy docs to the permissions scope (Rafael Gonzaga) #44222 - [
57dac53c22
] - doc,crypto: cleanup removed pbkdf2 behaviours (Filip Skokan) #44733 - [
c209bd6fb9
] - doc,inspector: document changes of inspector.close (Chengzhong Wu) #44628 - [
9b3b7d6978
] - esm,loader: tidy ESMLoader internals (Jacob Smith) #44701 - [
daf63d2fa3
] - fs: fix typo in mkdir example (SergeyTsukanov) #44791 - [[`85ab2...
2022-09-23, Version 18.9.1 (Current), @RafaelGSS
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- Insufficient fix for macOS devices on v18.5.0
- CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
- CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
- CVE-2022-35255: Weak randomness in WebCrypto keygen
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
llhttp updated to 6.0.10
llhttp
is updated to 6.0.10 which includes fixes for the following vulnerabilities.
- HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The
llhttp
parser in thehttp
module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). - HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The
llhttp
parser in thehttp
module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). - HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the
http
does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
Commits
- [
0c2a5723be
] - crypto: fix weak randomness in WebCrypto keygen (Ben Noordhuis) nodejs-private/node-private# - [
ffb6f4d51d
] - deps: MacOS - fix location of OpenSSL config file (Michael Dawson) nodejs-private/node-private#345 - [
01bffcdd93
] - http: disable chunked encoding when OBS fold is used (Paolo Insogna) nodejs-private/node-private#341 - [
2c379d341d
] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337
2022-09-23, Version 16.17.1 'Gallium' (LTS), @ruyadorno
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- CVE-2022-32213: bypass via obs-fold mechanic (Medium)
- CVE-2022-35255: Weak randomness in WebCrypto keygen
- CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
Commits
- [
a54283a638
] - crypto: fix weak randomness in WebCrypto keygen (Ben Noordhuis) nodejs-private/node-private#346 - [
0713e21240
] - http: disable chunked encoding when using OBS fold is used (Paolo Insogna) nodejs-private/node-private#341 - [
77fe2f32e4
] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337
2022-09-23, Version 14.20.1 'Fermium' (LTS), @bengl
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- CVE-2022-32213: bypass via obs-fold mechanic (Medium)
- CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
Commits
- [
a9f1146b88
] - http: disable chunked encoding when OBS fold is used (Paolo Insogna) nodejs-private/node-private#341 - [
a1121b456c
] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337 - [
de80707870
] - src: fix IS_LTS and IS_RELEASE flags (Richard Lau) #43761