PR-URL: nodejs/node#53486

PR-URL: nodejs-private/node-private#584
Refs: https://hackerone.com/reports/2472071
CVE-ID: CVE-2024-36137

PR-URL: nodejs-private/node-private#486
Backport-PR-URL: nodejs-private/node-private#604
CVE-ID: CVE-2024-22018

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs/node#52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: nodejs-private/node-private#596
Backport-PR-URL: nodejs-private/node-private#605
CVE-ID: CVE-2024-36138

PR-URL: nodejs-private/node-private#522
CVE-ID: CVE-2024-22020

PR-URL: nodejs-private/node-private#581
CVE-ID: CVE-2024-37372

This is a security release.

Notable changes:

* CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
* CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
* CVE-2024-22018 - fs.lstat bypasses permission model (Low)
* CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
* CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

PR-URL: nodejs-private/node-private#608

2024-07-08 Node.js v20.15.1 'Iron' (LTS) Release
Git-EVTag-v0-SHA512: a9761cc35145f50e8e3606a285e2843b47e6b430b650c7449fcf4e246b064ff29e74b301dd9b92c0bdd022a8c8aec4a46cb43473864f0d4591f9f4052e1130bf

PR-URL: #153
Reviewed-by: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-by: RafaelGSS <rafael.nunu@hotmail.com>