Node.js 14: baixar versions anteriors

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
- CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
This security release also includes an npm update for Node.js 14 to address a number
of CVEs which either do not affect Node.js or are low severity in the context of Node.js. You
can get more details for the individual CVEs in
nodejs-dependency-vuln-assessments.
Commits
- [97a0443f13] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
- [9e6221529b] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46566
- [0d5f86451d] - deps: update archs files for OpenSSL-1.1.1t (RafaelGSS) #46566
- [8c11d17b40] - deps: upgrade openssl sources to 1.1.1t (RafaelGSS) #46566
- [224e93c9ef] - deps: upgrade npm to 6.14.18 (Ruy Adorno) #45936
- [d73ea4de13] - doc: clarify release notes for Node.js 14.21.2 (Richard Lau) #45846
- [f7892c16be] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
- [fa115ee8ac] - module: protect against prototype mutation (Antoine du Hamel) #44007
- [83975b7fb4] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
- [a5f8798d7a] - test: avoid left behind child processes (Richard Lau) #46276

Notable Changes
OpenSSL 1.1.1s
This update is a bugfix release and does not address any security
vulnerabilities.
Root certificates updated to NSS 3.85
Certificates added:
- Autoridad de Certificacion Firmaprofesional CIF A62634068
- Certainly Root E1
- Certainly Root R1
- D-TRUST BR Root CA 1 2020
- D-TRUST EV Root CA 1 2020
- DigiCert TLS ECC P384 Root G5
- DigiCert TLS RSA4096 Root G5
- E-Tugra Global Root CA ECC v3
- E-Tugra Global Root CA RSA v3
- HiPKI Root CA - G1
- ISRG Root X2
- Security Communication ECC RootCA1
- Security Communication RootCA3
- Telia Root CA v2
- vTrus ECC Root CA
- vTrus Root CA
Certificates removed:
- Cybertrust Global Root
- DST Root CA X3
- GlobalSign Root CA - R2
- Hellenic Academic and Research Institutions RootCA 2011
Time zone update to 2022f
Time zone data has been updated to 2022f. This includes changes to Daylight
Savings Time (DST) for Fiji and Mexico. For more information, see
https://mm.icann.org/pipermail/tz-announce/2022-October/000075.html.
Commits
- [436a596e99] - crypto: update root certificates (Luigi Pinca) #45490
- [4b422d34af] - deps: V8: cherry-pick d2db7fa7f786 (Richard Lau) #45785
- [625f4bf3a9] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #45331
- [48a9810de8] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #45235
- [9f4e64b603] - deps: update timezone to 2022f (Richard Lau) #45521
- [f297b6bd21] - deps: update archs files for OpenSSL-1.1.1s (RafaelGSS) #45272
- [11629fef15] - deps: upgrade openssl sources to 1.1.1s (RafaelGSS) #45272
- [c3a90c4b44] - http2: fix memory leak when nghttp2 hd threshold is reached (rogertyang) #41502
- [785dc3efee] - module: cjs-module-lexer WebAssembly fallback (Guy Bedford) #43612
- [2dbeb889f6] - node-api: handle no support for external buffers (Michael Dawson) #45181
- [5b2ea124f3] - test: add test to validate changelogs for releases (Richard Lau) #45325
- [f13f889956] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #45299
- [5608e6fa72] - tools: update certdata.txt (Luigi Pinca) #45490
- [d6f1d7107b] - tools: have test-asan use ubuntu-20.04 (Filip Skokan) #45581
- [370a00f737] - tools: make license-builder.sh comply with shellcheck 0.8.0 (Rich Trott) #41258

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.
Commits
- [2b433af094] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

Notable changes
- deps:
- update corepack to 0.14.2 (Node.js GitHub Bot) #44775
- src:
- add --openssl-shared-config option (Daniel Bevenius) #43124
Commits
- [773f587912] - deps: cherry-pick libuv/libuv@3a7b955 (Ben Noordhuis) #43950
- [a1dea66956] - deps: cherry-pick libuv/libuv@abb109f (Ben Noordhuis) #43950
- [98c49d81f5] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775
- [18c43c8518] - deps: update timezone to tz2022e (Richard Lau) #45094
- [a1f8e4db48] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704
- [e55389ca86] - deps: update corepack to 0.14.0 (Node.js GitHub Bot) #44509
- [0227462418] - deps: update corepack to 0.13.0 (Node.js GitHub Bot) #44318
- [ee24c320ea] - deps: update corepack to 0.12.3 (Node.js GitHub Bot) #44229
- [28e9891449] - deps: update corepack to 0.12.2 (Node.js GitHub Bot) #44159
- [b6972c9df2] - deps: update corepack to 0.12.1 (Node.js GitHub Bot) #43965
- [9d6cb3b5f1] - deps: update corepack to 0.12.0 (Node.js GitHub Bot) #43748
- [fa6c276b4f] - deps: update Corepack to 0.11.2 (Maël Nison) #43402
- [4f83d75626] - (SEMVER-MAJOR) src,doc,test: add --openssl-shared-config option (Daniel Bevenius) #43124
- [9487028043] - test: fix intl tests on small-icu builds (Antoine du Hamel) #41939
- [a1d52097f8] - tools: add more options to track flaky tests (Antoine du Hamel) #43954

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- CVE-2022-32213: bypass via obs-fold mechanic (Medium)
- CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
Commits
- [a9f1146b88] - http: disable chunked encoding when OBS fold is used (Paolo Insogna) nodejs-private/node-private#341
- [a1121b456c] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337
- [de80707870] - src: fix IS_LTS and IS_RELEASE flags (Richard Lau) #43761

This is a security release.
Notable Changes
- [8e8aef836c] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124
- [98965b137d] - deps: upgrade openssl sources to 1.1.1q (RafaelGSS) #43686
Commits
- [b93e048bf6] - deps: update archs files for OpenSSL-1.1.1q (RafaelGSS) #43686
- [98965b137d] - deps: upgrade openssl sources to 1.1.1q (RafaelGSS) #43686
- [837a1d803e] - deps: update archs files for OpenSSL-1.1.1p (RafaelGSS) #43527
- [c5d9c9a49e] - deps: upgrade openssl sources to 1.1.1p (RafaelGSS) #43527
- [da0fda0fe8] - http: stricter Transfer-Encoding and header separator parsing (Paolo Insogna) #315
- [48c5aa5cab] - src: fix IPv4 validation in inspector_socket (Tobias Nießen) nodejs-private/node-private#320
- [8e8aef836c] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124

Notable Changes
- This release updates OpenSSL to 1.1.1o. This update is not being treated as a security release as the issues addressed in OpenSSL 1.1.1o were assessed to not affect Node.js 14. See https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-may2022/ for more information on how the May 2022 OpenSSL releases affects other Node.js release lines.
- The list of GPG keys used to sign releases has been synchronized with the main branch.
Commits
- [68397e49d9] - deps: update archs files for OpenSSL-1.1.1o (RafaelGSS) #42956
- [7f9a5ed4a8] - deps: upgrade openssl sources to 1.1.1o (RafaelGSS) #42956
- [61eba58cb6] - doc: add release key for Juan Arboleda (Juan José) #42961

Notable Changes
doc:
- New release key for Bryan English
Learn more at: https://github.com/nodejs/node/pull/42102
Contributed by Bryan English (@bengl)
npm:
- Upgrade npm to v6.14.17.
Learn more at: https://github.com/nodejs/node/pull/42900
Contributed by Ruy Adorno (@ruyadorno)
V8:
- V8 had a stack overflow issue affecting the vm module, cherry-picking cc9a8a37445e
from V8 solves this issue.
Learn more at: https://github.com/nodejs/node/pull/41826
Contributed by Gus Caplan (@devsnek)
- Using getHeapSnapshot() was causing a Node.js crash due a V8 issue, this is fixed by backporting 367b0c1e7a32
from V8.
Learn more at: https://github.com/nodejs/node/pull/42637
Contributed by Chengzhong Wu (@legendecas)
Commits
- [c73ac527d6] - build: set DESTCPU correctly for 'make binary' on Apple Silicon (Chris Heisterkamp) #40147
- [dcaed6db24] - build: use ccache in make-v8.sh on ppc64le and s390x (Richard Lau) #42204
- [4203d132b1] - child_process: queue pending messages (Erick Wendel) #41221
- [a3ebdbfe8f] - deps: upgrade npm to 6.14.17 (Ruy Adorno) #42900
- [39e44f8382] - deps: V8: cherry-pick cc9a8a37445e (Gus Caplan) #41826
- [b52a268b6f] - deps: V8: cherry-pick 367b0c1e7a32 (legendecas) #42637
- [77ba012065] - doc: fix documentation of FileHandle.prototype.appendFile (Antoine du Hamel) #42588
- [3d3d7ed1b7] - doc: specify flag needed for JSON and Wasm modules (Rich Trott) #42736
- [542d812c93] - doc: use openpgp.org for keyserver examples (Nick Schonning) #39227
- [7f2825b1a9] - doc: add release key for Bryan English (Bryan English) #42102
- [75302d3dce] - fs: fix write methods param validation and docs (Livia Medeiros) #41677
- [d4171e0eac] - stream: resume stream on drain (Robert Nagy) #41848
- [de474c8b6f] - worker: do not send message if port is closing (Rich Trott) #42357

This is a security release.
Notable Changes
Update to OpenSSL 1.1.1n, which addresses the following vulnerability:
- Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778)
More details are available at https://www.openssl.org/news/secadv/20220315.txt
Commits
- [b5c52e337e] - build: pin Windows GitHub runner to windows-2019 (Richard Lau) #42350
- [3b1a0b24f0] - deps: update archs files for OpenSSL-1.1.1n (Richard Lau) #42347
- [c83dd99e0b] - deps: upgrade openssl sources to 1.1.1n (Richard Lau) #42347

Notable Changes
Corepack
Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development.
In practical terms, Corepack will let you use Yarn and pnpm without having to install them - just like what currently happens with npm, which is shipped in Node.js by default.
Please head over to the Corepack documentation page for more information on how to use it.
Contributed by Maël Nison - #39608
ICU updated
ICU has been updated to 70.1. This updates timezone database to 2021a3, including bringing forward the start for DST for Jordan from March to February.
Contributed by Michaël Zasso - #40658
New option to disable loading of native addons
A new command line option --no-addons has been added to disallow loading of native addons.
Contributed by Dominic Elm - #39977
Updated Root Certificates
Root certificates have been updated to those from Mozilla's Network Security Services 3.71.
Contributed by Richard Lau - #40280
Other Notable Changes
- [0d448eaab5] - (SEMVER-MINOR) crypto: make FIPS related options always available (Vít Ondruch) #36341
- [004eafbebf] - (SEMVER-MINOR) lib: add unsubscribe method to non-active DC channels (simon-id) #40433
- [625be7585d] - (SEMVER-MINOR) lib: add return value for DC channel.unsubscribe (simon-id) #40433
- [607bc74eae] - (SEMVER-MINOR) module: support pattern trailers (Guy Bedford) #39635
- [f74fe2a59c] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #39926
Commits
- [0231ffa501] - build: add --without-corepack (Jonah Snider) #41060
- [5389b8ab05] - crypto: update root certificates (Richard Lau) #40280
- [0d448eaab5] - (SEMVER-MINOR) crypto: make FIPS related options always available (Vít Ondruch) #36341
- [cd20ecc7cb] - deps: upgrade Corepack to 0.10 (Maël Nison) #40374
- [737df75e17] - (SEMVER-MINOR) deps: add corepack (Maël Nison) #39608
- [b85aa5a143] - deps: upgrade npm to 6.14.16 (Ruy Adorno) #41603
- [2755d391a5] - deps: update ICU to 70.1 (Michaël Zasso) #40658
- [3089326d89] - deps: update archs files for OpenSSL-1.1.1m (Richard Lau) #41173
- [59da7c12aa] - deps: upgrade openssl sources to 1.1.1m (Richard Lau) #41173
- [cede1f26f6] - deps: add -fno-strict-aliasing flag to libuv (Daniel Bevenius) #40631
- [4477da858f] - doc: fix corepack grammar for --force flag (Steven) #40762
- [5971d58600] - doc: add missing YAML tag in esm.md (Antoine du Hamel) #41516
- [e903798ae1] - doc: add note regarding unfinished TLA (Antoine du Hamel) #41434
- [a90defebcf] - esm: make process.exit() default to exit code 0 (Gang Chen) #41388
- [fc328f1ab0] - fs: nullish coalescing to respect zero positional reads (Omar El-Mihilmy) #40716
- [004eafbebf] - (SEMVER-MINOR) lib: add unsubscribe method to non-active DC channels (simon-id) #40433
- [625be7585d] - (SEMVER-MINOR) lib: add return value for DC channel.unsubscribe (simon-id) #40433
- [2c365961d0] - module: support pattern trailers for imports field (Guy Bedford) #40041
- [607bc74eae] - (SEMVER-MINOR) module: support pattern trailers (Guy Bedford) #39635
- [f74fe2a59c] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #39926
- [b050c65885] - src: add option to disable loading native addons (Dominic Elm) #39977
- [c1695ac68a] - tools: update certdata.txt (Richard Lau) #40280

This is a security release.
Notable changes
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44531 after publication.
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44532 after publication.
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
More details will be available at CVE-2021-44533 after publication.
Prototype pollution via console.table properties (Low)(CVE-2022-21824)
Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.
Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.
More details will be available at CVE-2022-21824 after publication.
Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.
Commits
- [e2a74f3c99] - console: fix prototype pollution via console.table (Tobias Nießen) nodejs-private/node-private#307
- [df1b2c33f6] - crypto,tls: implement safe x509 GeneralName format (Tobias Nießen and Akshay Kumar) nodejs-private/node-private#300
- [9f2c52617f] - src: add cve reverts and associated tests (Michael Dawson and Akshay Kumar) nodejs-private/node-private#300
- [b14be42518] - src: remove unused x509 functions (Tobias Nießen and Akshay Kumar) nodejs-private/node-private#300
- [83d8f880bb] - tls: fix handling of x509 subject and issuer (Tobias Nießen and Akshay Kumar) nodejs-private/node-private#300
- [461a0c674b] - tls: drop support for URI alternative names (Tobias Nießen and Akshay Kumar) nodejs-private/node-private#300

Notable changes
This release contains a c-ares update to fix a regression introduced in
Node.js 14.17.5 resolving CNAME records containing underscores
#39780.
Also included are commits to allow Node.js 14 to continue to build and
pass tests on our Jenkins CI, including adding Python 3.10 to the list
of allowable Python versions for building.
Commits
- [7923c61a62] - build: pin build-docs workflow to Node.js 14 (Richard Lau) #40939
- [da356128fb] - build: support Python 3.10.0 (FrankQiu) #40296
- [9c3a85d279] - deps: update c-ares to 1.18.1 (Richard Lau) #40660
- [cd7c340545] - deps: V8: patch jinja2 for Python 3.10 compat (Michaël Zasso) #40296
- [6330d435f5] - doc: mark Node.js 10 as End-of-Life (Richard Lau) #38482
- [8ca082ec71] - doc: fix CJS-ESM selector in Safari (Bradley Farias) #40135
- [92490d1c89] - doc: add macOS arm64 experimental status (Michael Rienstra) #40127
- [8894bdd4d8] - lib: fix regular expression to detect `/` and `\` (Francesco Trotta) #40325
- [704989b698] - test: deflake child-process-pipe-dataflow (Luigi Pinca) #40838
- [df401cd346] - test: update upload.zip to be uncorrupted (Greg Ziskind) #37294
- [aa947f7dbf] - tools: add script to update c-ares (Richard Lau) #40660
- [6b7b2bba41] - tools: patch jinja2 for Python 3.10 compat (Michaël Zasso) #40296
- [39583f77d8] - worker: avoid potential deadlock on NearHeapLimit (Santiago Gimeno) #38403

This is a security release.
Notable changes
- CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
- The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
- CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
- The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.
Commits
- [8c254ca7e4] - deps: update llhttp to 2.1.4 (Fedor Indutny) nodejs-private/node-private#285
- [9b92ae2499] - http: add regression test for smuggling content length (Matteo Collina) nodejs-private/node-private#285
- [f467539719] - http: add regression test for chunked smuggling (Matteo Collina) nodejs-private/node-private#285

This is a security release.
Notable Changes
These are vulnerabilities in the node-tar, arborist, and npm cli modules which
are related to the initial reports and subsequent remediation of node-tar
vulnerabilities CVE-2021-32803
and CVE-2021-32804.
Subsequent internal security review of node-tar and additional external bounty
reports have resulted in another 5 CVE being remediated in core npm CLI
dependencies including node-tar, and npm arborist.
You can read more about it in:
- CVE-2021-37701
- CVE-2021-37712
- CVE-2021-37713
- CVE-2021-39134
- CVE-2021-39135
Commits
- [5b3f70bfb5] - deps: update archs files for OpenSSL-1.1.1l (Richard Lau) #39868
- [71372625ae] - deps: upgrade openssl sources to 1.1.1l (Richard Lau) #39868
- [4276984803] - deps: upgrade npm to 6.14.15 (Darcy Clarke) #39856

This is a security release.
Notable Changes
- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
- Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
- CVE-2021-22940: Use after free on close http2 on stream canceling (High)
- Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940.
- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
- If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.
Commits
- [4923b59e0b] - deps: update c-ares to 1.17.2 (Beth Griggs) #39724
- [847a4c6a8a] - deps: reflect c-ares source tree (Beth Griggs) #39653
- [33208e2f89] - deps: apply missed updates from c-ares 1.17.1 (Beth Griggs) #39653
- [af5c1af9a4] - http2: add tests for cancel event while client is paused reading (Akshay K) #39622
- [434872e838] - http2: update handling of rst_stream with error code NGHTTP2_CANCEL (Akshay K) #39622
- [35b86110e4] - tls: validate "rejectUnauthorized: undefined" (Matteo Collina) nodejs-private/node-private#276

Notable Changes
Node.js 14.17.2 introduced a regression in the Windows installer on
non-English locales that is being fixed in this release. There is no
need to download this release if you are not using the Windows
installer.
Commits
- [0f00104a2c] - win,msi: use localized "Authenticated Users" name (Richard Lau) #39241

This is a security release.
Notable Changes
Vulnerabilities fixed:
- CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
- Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
- CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
- Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
Commits
- [a7496aba0a] - deps: uv: cherry-pick 99c29c9c2c9b (Ben Noordhuis) nodejs-private/node-private#267
- [d0b449da1d] - win,msi: set install directory permission (AkshayK) nodejs-private/node-private#269

This is a security release.
Notable Changes
Vulnerabilities fixed:
- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)
- This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
- Impacts:
- All versions of the 14.x, 12.x and 10.x releases lines
Commits
- [467be7a950] - deps: upgrade npm to 6.14.12 (Ruy Adorno) #37918
- [6bc8f58182] - deps: update archs files for OpenSSL-1.1.1k (Tobias Nießen) #37938
- [403a014ef6] - deps: upgrade openssl sources to 1.1.1k (Tobias Nießen) #37938

This is a security release.
Notable changes
Vulnerabilities fixed:
- CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
- Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
- CVE-2021-22884: DNS rebinding in --inspect
- Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
- CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt
Commits
- [313d26800c] - deps: update archs files for OpenSSL-1.1.1j (Daniel Bevenius) #37412
- [6098012b48] - deps: upgrade openssl sources to 1.1.1j (Daniel Bevenius) #37412
- [afea10b097] - (SEMVER-MINOR) http2: add unknownProtocol timeout (Daniel Bevenius) nodejs-private/node-private#246
- [1ca3f5abcb] - src: drop localhost6 as allowed host for inspector (Matteo Collina) nodejs-private/node-private#244

Notable Changes
- deps:
- upgrade npm to 6.14.11 (Ruy Adorno) #37173
- V8: backport dfcf1e86fac0 (Michaël Zasso) #37245
- Note: Node.js is not believed to be vulnerable to CVE-2021-21148.
- stream,zlib: do not use _stream_* anymore (Matteo Collina) #36618
Commits
- [20b1e6c802] - deps: V8: backport dfcf1e86fac0 (Michaël Zasso) #37245
- [408c7a65f3] - deps: upgrade npm to 6.14.11 (Ruy Adorno) #37173
- [017eed665b] - http: do not loop over prototype in Agent (Michaël Zasso) #36410
- [25a3204fe2] - http: don't cork .end when not needed (Dimitris Halatsis) #36633
- [2a1e4e9244] - stream: accept iterable as a valid first argument (ZiJian Liu) #36479
- [9ff73fcdbe] - stream,zlib: do not use _stream_* anymore (Matteo Collina) #36618
- [c03cddb46f] - test: http complete response after socket double end (Dimitris Halatsis) #36633
- [f206505e9d] - util: fix instanceof checks with null prototypes during inspection (Ruben Bridgewater) #36178
- [2f7944b18b] - util: fix module prefixes during inspection (Ruben Bridgewater) #36178

This is a security release.
Notable Changes
Vulnerabilities fixed:
- CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)
- This is a vulnerability in OpenSSL which may be exploited through
Node.js. You can read more about it in
https://www.openssl.org/news/secadv/20201208.txt
- CVE-2020-8265: use-after-free in TLSWrap (High)
- Affected Node.js versions are vulnerable to a use-after-free bug in
its TLS implementation. When writing to a TLS enabled socket,
nodeStreamBaseWrite calls nodeTLSWrapDoWrite with a freshly
allocated WriteWrap object as first argument. If the DoWrite method
does not return an error, this object is passed back to the caller as
part of a StreamWriteResult structure. This may be exploited to
corrupt memory leading to a Denial of Service or potentially other
exploits.
- CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)
- Affected versions of Node.js allow two copies of a header field in
a http request. For example, two Transfer-Encoding header fields. In
this case Node.js identifies the first header field and ignores the
second. This can lead to HTTP Request Smuggling
(https://cwe.mitre.org/data/definitions/444.html).
Commits
- [305c0f4977] - deps: upgrade npm to 6.14.10 (Ruy Adorno) #36571
- [d62c650f75] - deps: update archs files for OpenSSL-1.1.1i (Myles Borins) #36521
- [2de2672eb5] - deps: upgrade openssl sources to 1.1.1i (Myles Borins) #36521
- [7ecac8143f] - http: add test for http transfer encoding smuggling (Matteo Collina) nodejs-private/node-private#228
- [641f786bb1] - http: unset F_CHUNKED on new Transfer-Encoding (Matteo Collina) nodejs-private/node-private#228
- [4f8772f9b7] - src: retain pointers to WriteWrap/ShutdownWrap (James M Snell) nodejs-private/node-private#23

Notable Changes
Node.js v14.15.2 included a commit that has caused reported breakages when cloning request objects. This release reverts the commit that introduced the behaviour change. See https://github.com/nodejs/node/issues/36550 for more details.
Commits
- [4264d9aa67] - Revert "http: lazy create IncomingMessage.headers" (Beth Griggs) #36553

Notable changes
This is a security release.
Vulnerabilities fixed:
- CVE-2020-8277: Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.
Commits
- [1fd2c8142b] - deps: cherry-pick 0d252eb from upstream c-ares (Michael Dawson) nodejs-private/node-private#231

Notable Changes
This release marks the transition of Node.js 14.x into Long Term Support (LTS)
with the codename 'Fermium'. The 14.x release line now moves into "Active LTS"
and will remain so until October 2021. After that time, it will move into
"Maintenance" until end of life in April 2023.
Commits
- [5b7a08c902] - doc: add missing link in Node.js 14 Changelog (Antoine du Hamel) #35782
- [90a5d59824] - doc: fix Node.js 14.x changelogs (Richard Lau) #35756
- [7f788573b3] - Revert "test: mark test-webcrypto-encrypt-decrypt-aes flaky" (Myles Borins) #35666

Notable Changes
- [7e7afc5186] - crypto: update certdata to NSS 3.56 (Shelley Vohr) #35546
- [8877430530] - doc: add aduh95 to collaborators (Antoine du Hamel) #35542
- [1610728d7c] - (SEMVER-MINOR) fs: add rm method (Ian Sutherland) #35494
- [6ff152cc67] - (SEMVER-MINOR) http: allow passing array of key/val into writeHead (Robert Nagy) #35274
- [93f947af0a] - (SEMVER-MINOR) src: expose v8::Isolate setup callbacks (Shelley Vohr) #35512
Commits
- [16c17ddd88] - build: fix Commit Queue failure comment (Antoine du Hamel) #35599
- [b7305284e2] - build: gitHub actions: Python 3.9 and actions/setup-python@v2 (Christian Clauss) #35521
- [e8fcbc8318] - build: fix landed message for multiple commits in commit-queue (Denys Otrishko) #35226
- [84c0adefa0] - build: add Commit Queue actions url to failure comment (Denys Otrishko) #35206
- [9c74d4598d] - build: fuzzer that targets node::LoadEnvironment() (davkor) #34844
- [f552e5c251] - build: improved release lint error message (Shelley Vohr) #35523
- [7e7afc5186] - crypto: update certdata to NSS 3.56 (Shelley Vohr) #35546
- [b8529a7104] - deps: V8: cherry-pick 3176bfd447a9 (Anna Henningsen) #35612
- [0c877762ea] - doc: document Buffer.concat may use internal pool (Andrey Pechkurov) #35541
- [6284f0dbc2] - doc: use test username instead of real (Pooja D.P) #35611
- [78259b6519] - doc: add doc for starting ci job via label (Juan José Arboleda) #35551
- [41d7500bf9] - doc: fix unit of size argument of readable.read (Tobias Nießen) #35051
- [00eff4a534] - doc: add missing deprecation number (Benjamin Coe) #35630
- [9288f9d74b] - doc: harmonize YAML comments (Antoine du Hamel) #35575
- [16f8298170] - doc: revise description of process.ppid (Pooja D.P) #35589
- [cad86d40de] - doc: add symlink information for process.execpath (Pooja D.P) #35590
- [4025fc811d] - doc: add PoojaDurgad as a triager (Pooja D.P) #35153
- [809cd07968] - doc: document rmdir/recursive deprecation (Benjamin Coe) #35579
- [9d1b7ac334] - doc: edit fs.md for minor style changes (Rich Trott) #35505
- [c1bb364105] - doc: run license builder (Myles Borins) #35577
- [970975b588] - doc: use kbd element in process doc (Rich Trott) #35584
- [64ebbddb5f] - doc: fixup perf_hooks (Antoine du Hamel) #35527
- [b074717af7] - doc: remove incorrect synchronous label (Colin Ihrig) #35561
- [ddf13e0df0] - doc: make fs.rm()'s force docs consistent (Colin Ihrig) #35561
- [4164477b43] - doc: simplify wording in tracing APIs doc (Pooja D.P) #35556
- [c865b02397] - doc: improve SIGINT error text (Rich Trott) #35558
- [7d1cdd411f] - doc: move package.import content higher (Myles Borins) #35535
- [62755b6230] - doc: harmonize changes list ordering (Antoine du Hamel) #35454
- [8cacca0f62] - doc: changes description must end with a period (Antoine du Hamel) #35454
- [28c94ca123] - doc: harmonize version list style in YAML comments (Antoine du Hamel) #35454
- [b3f15b7d89] - doc: fix missing PR-URLs in YAML comments (Antoine du Hamel) #35454
- [02bf73e239] - doc: remove outstanding YAML comment (Antoine du Hamel) #35454
- [a5552468d2] - doc: harmonize YAML comments style in deprecations.md (Antoine du Hamel) #35454
- [863ba4b7da] - doc: refactor the n-api matrix (Michael Dawson) #35345
- [85dc84d1bb] - doc: use sentence case for class property (Rich Trott) #35540
- [01c9c59c85] - doc: add history entry for exports patterns (Antoine du Hamel) #35410
- [51b988ba0f] - doc: fix deprecation history (Antoine du Hamel) #35455
- [328c624cdf] - doc: fix util.inspect change history (Antoine du Hamel) #35528
- [d53cfcd9e7] - doc: improve kbd element rendering (Rich Trott) #35497
- [8877430530] - doc: add aduh95 to collaborators (Antoine du Hamel) #35542
- [8cdc59b34c] - doc: fix YAML syntax errors (Antoine du Hamel) #35529
- [3c90b1a278] - errors: support possible deletion of globalThis.Error (Michaël Zasso) #35499
- [a3c7f8e576] - fs: rimraf should not recurse on failure (Benjamin Coe) #35566
- [939f8e8bfa] - fs: throw rm() validation errors (Colin Ihrig) #35602

Notable Changes
- fs:
- remove experimental from rmdir recursive (Benjamin Coe) #35171
Commits
- [f36476d9d6] - build: fix CQ after latest ncu release (Mary Marchini) #35468
- [7dc6b2fac7] - build: add support for section ordering (Gabriel Schulhof) #35272
- [05e08bdf13] - console: add Symbol.toStringTag property (Leko) #35399
- [a01154e3fd] - crypto: fix KeyObject garbage collection (Anna Henningsen) #35481
- [1f15e34dc8] - crypto: set env values in KeyObject Deserialize method (ThakurKarthik) #35416
- [85062b3aad] - deps: update llhttp to 2.1.3 (Fedor Indutny) #35435
- [a995dd7a89] - doc: revise introductory child_process text (Rich Trott) #35344
- [6585b161ba] - doc: improve eventLoopUtilization documentation (Andrey Pechkurov) #35479
- [f08577c4a6] - doc: update AUTHORS list (Anna Henningsen) #35280
- [91ef862365] - doc: mention adding YAML for APIs in PR contributing guide (Denys Otrishko) #35459
- [885840b543] - doc: adopt MDN style for kbd elements (Rich Trott) #35460
- [1313c8c33a] - doc: update sxa's email address to Red Hat from IBM (Stewart X Addison) #35442
- [3f95440334] - doc: fix conditional exports flag removal version (Antoine du Hamel) #35428
- [e40876a5e5] - doc: specify how to detect EOF (Luigi Pinca) #35445
- [541ce17386] - doc: add entry to console.timeEnd() changes array (Luigi Pinca) #35441
- [38a5715c1a] - doc: avoid using deprecated connection property (Luigi Pinca) #35439
- [862b75d35e] - doc: added details around console.timeEnd changes (Yash Ladha) #35027
- [4dbb3a91fe] - doc: copyedit packages.md (Rich Trott) #35427
- [368a3ae415] - doc: update contact information for @BethGriggs (Beth Griggs) #35451
- [a11ddee8b9] - doc: update contact information for richardlau (Richard Lau) #35450
- [35b62ef0a7] - doc: importable node protocol URLs (Bradley Meck) #35434
- [95c62a1dca] - doc: copyedit esm.md (Rich Trott) #35414
- [86f2f83a2f] - doc: implement fancier rendering for keys (Rich Trott) #35400
- [d6427886b8] - doc: unhide resolver spec (Guy Bedford) #35358
- [5a730b5def] - doc: sort md references in ASCII order (Antoine du Hamel) #35191
- [ce789f1ca4] - doc: use .md extension for internal links (Antoine du Hamel) #35191
- [79e3e5008d] - doc: update example ICU URL (Daijiro Wachi) #35373
- [998b24ef17] - doc: align to function signature (anlex N) #34930
- [af360ace37] - doc: make minor edits for consistency (Rich Trott) #35377
- [53e27b3f67] - doc,esm: add history support info (Antoine du Hamel) #35395
- [91b820e939] - esm: use "node:" namespace for builtins (Guy Bedford) #35387
- [541be526c3] - fs: do not throw exception after creating FSReqCallback (Anna Henningsen) #35487
- [f29451dece] - fs: simplify realpathSync (himself65) #35413
- [fcbdb0686d] - fs: remove experimental from rmdir recursive (Benjamin Coe) #35171
- [e4a4f81d19] - fs: use Promise.resolve from primordials (Michaël Zasso) #35379
- [8e3a81eed9] - http2,tls: store WriteWrap using BaseObjectPtr (Anna Henningsen) #35488
- [62ddc77a5b] - meta: add nodejs/streams to CODEOWNERS (Matteo Collina) #35411
- [23022066ec] - meta: add startup team in CODEOWNERS (Joyee Cheung) #35406
- [0ac5fa703e] - module: update to cjs-module-lexer@0.4.0 (Guy Bedford) #35501
- [5c879a97e6] - module: fix builtin reexport tracing (Guy Bedford) #35500
- [f23a0e250c] - module: refine module type mismatch error cases (Guy Bedford) #35426
- [3f62f997a2] - src: more idiomatic error pattern in node_wasi (James M Snell) #35493
- [392c8815fe] - src: use env->ThrowUVException in pipe_wrap (James M Snell) #35493
- [e09f7f023a] - src: limit GetProcessTitle() result to 1MB (Anna Henningsen) #35492
- [fbb9dd9ac9] - src: fix aliased buffer import warning in env.h (Yash Ladha) #35436
- [7bbf8ee256] - src: remove invalid ToLocalChecked in EmitBeforeExit (Anna Henningsen) #35484
- [5a85d4f2c6] - src: make MakeCallback() check can_call_into_js before getting method (Anna Henningsen) #35424
- [4aed176b68] - src: document required else block at src/node_platform.cc (Juan José Arbole

Notable Changes
- [19b95a7fa9] - (SEMVER-MINOR) deps: upgrade to libuv 1.40.0 (Colin Ihrig) #35333
- [f551f52f83] - (SEMVER-MINOR) module: named exports for CJS via static analysis (Guy Bedford) #35249
- [505731871e] - (SEMVER-MINOR) module: exports pattern support (Guy Bedford) #34718
- [0d8eaa3942] - (SEMVER-MINOR) src: allow N-API addon in AddLinkedBinding() (Anna Henningsen) #35301
Commits
- [19b95a7fa9] - (SEMVER-MINOR) deps: upgrade to libuv 1.40.0 (Colin Ihrig) #35333
- [353a567235] - deps: upgrade to c-ares v1.16.1 (Shelley Vohr) #35324
- [2e10616d48] - doc: remove http2 non-link anchor tags (Rich Trott) #35161
- [02db136c49] - doc: alphabetize error list (Rich Trott) #35219
- [46a4154cab] - doc: packages docs feedback (Guy Bedford) #35370
- [70ad69ba46] - doc: outline when origin is set to unhandledRejection (Matthieu Larcher) #35294
- [010173a4b7] - doc: edit n-api.md for minor improvements (Rich Trott) #35361
- [86ac7497e0] - doc: add history entry for breaking destroy() change (Gil Pedersen) #35326
- [857e321baf] - doc: set encoding to hex before piping hash (Victor Antonio Barzana Crespo) #35338
- [87dfed012c] - doc: add gpg key export directions to releases doc (Danielle Adams) #35298
- [1758ac8237] - doc: added version 7 to N-API version matrix (NickNaso) #35319
- [5da5d41b1c] - doc: refine require/import conditions constraints (Guy Bedford) #35311
- [482ce6ce1d] - doc: improve N-API string-to-native doc (Gabriel Schulhof) #35322
- [6dc6dadfc6] - doc: avoid referring to C array size (Tobias Nießen) #35300
- [0a847ca729] - doc: update napi_make_callback documentation (Gerhard Stoebich) #35321
- [a8d3a7f742] - doc: put landing specifics in details tag (Rich Trott) #35296
- [dd530364d0] - doc: fixup lutimes metadata (Anna Henningsen) #35328
- [d7282c0ae3] - doc: edit subpath export patterns introduction (Rich Trott) #35254
- [1d1ce1fc2c] - doc: document support for package.json fields (Antoine du HAMEL) #34970
- [ef0d2ef5a2] - doc: move package config docs to separate page (Antoine du HAMEL) #34748
- [b9d767c4d5] - doc: change type of child_process.signalCode to string (Linn Dahlgren) #35223
- [b4514d464d] - doc: replace "this guide" link text with guide title (Rich Trott) #35283
- [1893449724] - doc: revise dependency redirection text in policy.md (Rich Trott) #35276
- [0c4540b050] - doc: fix heading space bug in assert.md (Thomas Hunter II) #35310
- [ec6b78ae73] - doc: add socket.readyState (Clark Kozak) #35262
- [2a4ae0926d] - doc: update crypto.createSecretKey accepted types (Filip Skokan) #35246
- [c09f3dc2f3] - doc: put release script specifics in details (Myles Borins) #35260
- [99a79e32a6] - fs: fix fs.promises.writeFile with typed arrays (Michaël Zasso) #35376
- [ab7d0e92b1] - meta: update module pages in CODEOWNERS (Antoine du Hamel) #34932
- [f551f52f83] - (SEMVER-MINOR) module: named exports for CJS via static analysis (Guy Bedford) #35249
- [505731871e] - (SEMVER-MINOR) module: exports pattern support (Guy Bedford) #34718
- [68ea7f5560] - module: fix crash on multiline named cjs imports (Christoph Tavan) #35275
- [0f4ecaa741] - repl: standardize Control key indications (Rich Trott) #35270
- [1e1cb94e69] - src: fix incorrect SIGSEGV handling in NODE_USE_V8_WASM_TRAP_HANDLER (Anatoly Korniltsev) #35282
- [0d8eaa3942] - (SEMVER-MINOR) src: allow N-API addon in AddLinkedBinding() (Anna Henningsen) #35301
- [f2635b317e] - test: replace annonymous functions with arrow (Pooja D.P) #34921
- [d7c28c9243] - test,child_process: add tests for signalCode value (Rich Trott) #35327
- [80eb22185e] - tools: update ESLint to 7.10.0 (Colin Ihrig) #35366
- [7f355735df] - tools: ignore build folder when checking links (Ash Cripps) #35315
- [c5d27e1e29] - tools,doc: enforce alphabetical order for md refs (Antoine du Hamel) #35244
- [9d91842a9d] - tools,doc: upgrade dependencies (Antoine du Hamel) #35244

Notable changes
- deps:
- update to uvwasi 0.0.11 (Colin Ihrig) #35104
- n-api:
- create N-API version 7 (Gabriel Schulhof) #35199
- add more property defaults (Gerhard Stoebich) #35214
Commits
- [5229ffadcf] - buffer: adjust validation to account for buffer.kMaxLength (Anna Henningsen) #35134
- [3d78686987] - build: increase API requests for stale action (Phillip Johnsen) #35235
- [f2cc1c22c1] - build: filter issues & PRs to auto close by matching on stalled label (Phillip Johnsen) #35159
- [f3c45a1cef] - Revert "build: require "allow edits" to be checked" (Rich Trott) #35094
- [1bb0ed3c6a] - crypto: improve invalid arg type message for randomInt() (Rich Trott) #35089
- [3573545315] - crypto: improve randomInt out-of-range error message (Rich Trott) #35088
- [d4389b59b4] - deps: update to uvwasi 0.0.11 (Colin Ihrig) #35104
- [836680a4ea] - doc: use present tense in error messages (Rich Trott) #35164
- [b860a7f61c] - doc: standardize on _backward_ (Rich Trott) #35243
- [d82dd0c773] - doc: revise stability section of values doc (Rich Trott) #35242
- [2bc335dcf6] - doc: clarify napi_property_attributes text (Rich Trott) #35253
- [b62d9b47be] - doc: remove excessive formatting in dgram.md (Rich Trott) #35234
- [b9161f408f] - doc: sort repl references in ASCII order (Rich Trott) #35230
- [d195d20dbc] - doc: relax prohibition on personal pronouns (Rich Trott) #34353
- [6119e9511c] - doc: clarify use of NAPI_EXPERIMENTAL (Michael Dawson) #35195
- [6d4ab36175] - doc: update attributes used by n-api samples (#35220) (Gerhard Stoebich)
- [7610fe500e] - doc: add issue labels sections to release guide (Michaël Zasso) #35224
- [2308be06b3] - doc: fix header level for error code (Rich Trott) #35219
- [64ac5c68aa] - doc: fix small grammatical issues in timers.md (Turner Jabbour) #35203
- [92a14d3c72] - doc: add technical values document (Michael Dawson) #35145
- [dbfd3b261d] - doc: remove "end user" (Rich Trott) #35200
- [c1c93a6cde] - doc: use command-line/command line consistently (Rich Trott) #35198
- [70ec369b76] - doc: replace "you should do X" with "do X" (Rich Trott) #35194
- [e5fffe2f8f] - doc: fix missing word in dgram.md (Tom Atkinson) #35231
- [c1e16d15dd] - doc: fix deprecation documentation inconsistencies (Antoine du HAMEL) #35082
- [910deff2de] - doc: fix broken link in crypto.md (Rich Trott) #35181
- [066148d229] - doc: remove problematic auto-linking of curl man pages (Rich Trott) #35174
- [aea3f77c8d] - doc: update eventLoopUtilization documentation (Anna Henningsen) #35155
- [32d1731ae1] - doc: update process.release (schamberg97) #35167
- [176e9e4054] - doc: fix broken links in modules.md (Rich Trott) #35182
- [dc4c5696da] - doc: add missing copyFile change history (Shelley Vohr) #35056
- [e8d479ed67] - doc: perform cleanup on security-release-process.md (Rich Trott) #35154
- [99785e48ea] - doc: fix minor punctuation issue in path.md (Amila Welihinda) #35127
- [ae85228e54] - doc: perform minor cleanup on cli.md (Rich Trott) #35152
- [e4105140e7] - doc: improve table accessibility (Rich Trott) #35146
- [7dbcd24541] - doc: fix left nav color contrast (Rich Trott) #35141
- [331142ca25] - doc: update contact info for Ash Cripps (Ash Cripps) #35139
- [df70861863] - doc: simplify circular dependencies text in modules.md (Rich Trott) #35126
- [f4e714aaf5] - doc: update my email address (Michael Dawson) #35121
- [46b9f4b376] - doc: add missing changes entry for breakEvalOnSigint REPL option (Anna Henningsen) #35143
- [122edad98b] - doc: update security process (Michael Dawson) #35107
- [aa93c1c22d] - doc: fix broken link in perf_hooks.md (Rich Trott) #35113
- [5c8d2083c5] - doc: fix broken link in http2.md (Rich Trott) #35112
- [f4e958fc0c] - doc: fix broken link in fs.md (Rich Trott) #35111
- [79c6d92e49] - doc: fix broken links in deprecations.md (Rich Trott) #35109
- [93e4d545d8] - doc: add note about path.basename on Windows (Tobias Nießen) #35065
- [0a2610a7aa] - doc: avoid double-while sentence in perf_hooks.md (Rich Trott

Notable Changes
This is a security release.
Vulnerabilities fixed:
- CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical).
- CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).
Commits
- [dd828376a0] - deps: update llhttp to 2.1.2 (Fedor Indutny) nodejs-private/node-private#215
- [753f3b247a] - http: add requestTimeout (Matteo Collina, Paolo Insogna, Robert Nagy) nodejs-private/node-private#208

Notable Changes
- build: set --v8-enable-object-print by default (Mary Marchini) #34705
- deps:
- upgrade to libuv 1.39.0 (cjihrig) #34915
- upgrade npm to 6.14.8 (Ruy Adorno) #34834
- V8: cherry-pick e06ace6b5cdb (Anna Henningsen) #34673
- n-api: handle weak no-finalizer refs correctly (Gabriel Schulhof) #34839
- tools: add debug entitlements for macOS 10.15+ (Gabriele Greco) #34378
Commits
- [aaa6e43d3c] - Forces Powershell to use tls1.2 (Bartosz Sosnowski) #33609
- [8de6b72efa] - benchmark: add benchmark script for resourceUsage (Yash Ladha) #34691
- [e4450a199f] - benchmark: update function_args addon code (Anna Henningsen) #34725
- [332e38433b] - (SEMVER-MINOR) buffer: alias UInt ➡️ Uint in buffer methods (Anna Henningsen) #34729
- [7f0869f963] - build: run link checker in linter workflow (Richard Lau) #34810
- [9ca4b2ad5c] - build: add CODEOWNERS linter action (Mary Marchini) #34739
- [bdf26aebb4] - (SEMVER-MINOR) build: add build flag for OSS-Fuzz integration (davkor) #34761
- [d89a83c62c] - build: move compiling for Windows ARM64 to Tier 2 (João Reis) #34721
- [aed82379dd] - build: implement a Commit Queue in Actions (Mary Marchini) #34112
- [15c92083b5] - build: set --v8-enable-object-print by default (Mary Marchini) #34705
- [201d3d7074] - build: cover all benchmark addons with C++ linter (Anna Henningsen) #34725
- [2abc98e9ff] - build: add flag to build V8 with OBJECT_PRINT (Mary Marchini) #32834
- [6048421726] - build,win: use x64 Node when building for ARM64 (Dennis Ameling) #34009
- [69bcca122e] - crypto: avoid unitializing ECDH objects on error (Tobias Nießen) #34302
- [cf348542c6] - deps: upgrade to libuv 1.39.0 (cjihrig) #34915
- [68b7a8db6f] - deps: upgrade npm to 6.14.8 (Ruy Adorno) #34834
- [9527a2a8a7] - deps: V8: cherry-pick e06ace6b5cdb (Anna Henningsen) #34673
- [cd32522c92] - doc: add missing DEP ID for 'new crypto.Certificate()' (Beth Griggs) #34940
- [ff15c92a7f] - doc: improve fs doc intro (James M Snell) #34843
- [dae93ca0cb] - doc: indicate the format of process.version (Danny Guo) #34872
- [bf7f492cb6] - doc: rename module pages (Antoine du HAMEL) #34663
- [f2c2f42195] - doc: improve wording in deprecations.md (Rich Trott) #34860
- [4b3b0e3f98] - doc: fix ESM/CJS wrapper example (Maksim Sinik) #34853
- [d6bb2ad5ea] - doc: adopt Microsoft Style Guide officially (Rich Trott) #34821
- [e4679bd45d] - doc: use 'console' info string for console output (Rich Trott) #34837
- [b1c3fb73fc] - doc: fix bulleted list punctuation in BUILDING.md (Rich Trott) #34849
- [ef41ddf5cb] - doc: sort references lexically (Rich Trott) #34848
- [3133b75b68] - doc: move addaleax to TSC emeritus (Anna Henningsen) #34809
- [5214de78cd] - doc: remove space above version picker (Justice Almanzar) #34768
- [34430abd71] - doc: move module core module doc to separate page (Antoine du HAMEL) #34747
- [b356b79ca4] - doc: reorder deprecated tls docs (Jerome T.K. Covington) #34687
- [5c987ffc96] - doc: fix file name to main.mjs and not main.js in esm.md (Frank Lemanschik) #34786
- [969fb1c5e3] - doc: improve async_hooks snippets (Andrey Pechkurov) #34829
- [3360dcbfab] - doc: fix some typos and grammar mistakes (Hilla Shahrabani) #34800
- [47f2f45dd8] - doc: deprecate (doc-only) crypto.Certificate() (Rich Trott) #34697
- [3bfe199c28] - doc: remove "is recommended from crypto legacy API text (Rich Trott) #34697
- [258f64f578] - doc: edit filehandle.close() entry in fs.md (Rich Trott) #34782
- [e54a6842e0] - doc: fix broken links in commit-queue.md (Luigi Pinca) #34789
- [3925fd6550] - doc: avoid _may_ in collaborator guide (Rich Trott) #34749
- [cb0960635b] - doc: use sentence-casing for headers in collaborator guide (Rich Trott) #34713
- [8b5690287c] - doc: edit (general) collaborator guide (Rich Trott) #34712
- [b933eef1f3] - doc: reduce repetitiveness on Consensus Seeking (Mary Marchini) #34702
- [f7563f811a] - doc: remove typo in crypto.md (Rich Trott) #34698
- [ea98122a51] - doc: n-api environment life cycle APIs are stable (Jim 

Notable Changes
- [16aa927216] - (SEMVER-MINOR) async_hooks: add AsyncResource.bind utility (James M Snell) #34574
- [dc49561e8d] - deps: update to uvwasi 0.0.10 (Colin Ihrig) #34623
- [6cd1c41604] - doc: add Ricky Zhou to collaborators (rickyes) #34676
- [f0a41b2530] - doc: add release key for Ruy Adorno (Ruy Adorno) #34628
- [10dd7a0eda] - doc: add DerekNonGeneric to collaborators (Derek Lewis) #34602
- [62bb2e757f] - (SEMVER-MINOR) module: unflag Top-Level Await (Myles Borins) #34558
- [8cc9e5eb52] - (SEMVER-MINOR) n-api: support type-tagging objects (Gabriel Schulhof) #28237
- [e89ec46ba9] - (SEMVER-MINOR) n-api,src: provide asynchronous cleanup hooks (Anna Henningsen) #34572
Commits
- [650248922b] - async_hooks: avoid GC tracking of AsyncResource in ALS (Gerhard Stoebich) #34653
- [0a51aa8fdb] - async_hooks: avoid unneeded AsyncResource creation (Gerhard Stoebich) #34616
- [0af9bee4c3] - async_hooks: improve property descriptors in als.bind (Gerhard Stoebich) #34620
- [16aa927216] - (SEMVER-MINOR) async_hooks: add AsyncResource.bind utility (James M Snell) #34574
- [e45c68af27] - async_hooks: don't read resource if ALS is disabled (Gerhard Stoebich) #34617
- [e9aebc3a8f] - async_hooks: fix id assignment in fast-path promise hook (Andrey Pechkurov) #34548
- [5aed83c77f] - async_hooks: fix resource stack for deep stacks (Anna Henningsen) #34573
- [9af62641c6] - async_hooks: execute destroy hooks earlier (Gerhard Stoebich) #34342
- [14656e1703] - async_hooks: don't reuse resource in HttpAgent when queued (Andrey Pechkurov) #34439
- [c4457d873f] - benchmark: always throw the same Error instance (Anna Henningsen) #34523
- [6a129d0cf5] - build: do not run auto-start-ci on forks (Evan Lucas) #34650
- [2cd299b217] - build: run CI on release branches (Shelley Vohr) #34649
- [9ed9ccc5b3] - build: enable build for node-v8 push (gengjiawen) #34634
- [10f29e7550] - build: increase startCI verbosity and fix job name (Mary Marchini) #34635
- [befbaf384e] - build: don't run auto-start-ci on push (Mary Marchini) #34588
- [4af5dbd3bf] - build: fix auto-start-ci script path (Mary Marchini) #34588
- [70cf3cbdfa] - build: auto start Jenkins CI via PR labels (Mary Marchini) #34089
- [70e9eceeee] - build: toolchain.gypi and node_gyp.py cleanup (iandrc) #34268
- [465968c5f8] - console: document the behavior of console.assert() (iandrc) #34501
- [a7b4318df9] - crypto: add OP flag constants added in OpenSSL v1.1.1 (Mateusz Krawczuk) #33929
- [dc49561e8d] - deps: update to uvwasi 0.0.10 (Colin Ihrig) #34623
- [8b1ec43da4] - doc: use _Static method_ instead of _Class Method_ (Rich Trott) #34659
- [a1b9d7f42e] - doc: tidy some addons.md text (Rich Trott) #34654
- [b78278b922] - doc: use _Class Method_ in async_hooks.md (Rich Trott) #34626
- [6cd1c41604] - doc: add Ricky Zhou to collaborators (rickyes) #34676
- [d8e0deaa7c] - doc: edit process.title note for brevity and clarity (Rich Trott) #34627
- [dd6bf20e8f] - doc: update fs.watch() availability for IBM i (iandrc) #34611
- [f260bdd57b] - doc: fix typo in path.md (aetheryx) #34550
- [f0a41b2530] - doc: add release key for Ruy Adorno (Ruy Adorno) #34628
- [3f55dcd723] - doc: clarify process.title inconsistencies (Corey Butler) #34557
- [6cd9ea82f6] - doc: document the connection event for HTTP2 & TLS servers (Tim Perry) #34531
- [0a9389bb1a] - doc: mention null special-case for napi\_typeof (Renée Kooi) #34577
- [10dd7a0eda] - doc: add DerekNonGeneric to collaborators (Derek Lewis) #34602
- [d7eaf3a027] - doc: revise N-API versions matrix text (Rich Trott) #34566
- [e2bea73b03] - doc: clarify N-API version 1 (Michael Dawson) #34344
- [be23e23361] - doc: use consistent spelling for "falsy" (Rich Trott) #34545
- [f393ae9296] - doc: simplify and clarify console.assert() documentation (Rich Trott) #34544
- [b69ff2ff60] - doc: use consistent capitalization for addons (Rich Trott) #34536
- [212d17fa06] - doc: add mmarchini pronouns (Mary Marchini) #34586
- [7a28c3d543] - doc: update mmarchini contact info

Notable changes
This is a security release.
Vulnerabilities fixed:
- CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
- CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
Commits
- [07a4d5061f] - crypto: update root certificates (AshCripps) #33682
- [0a7bf50fd4] - (SEMVER-MINOR) deps: update nghttp2 to 1.41.0 (James M Snell) nodejs-private/node-private#204
- [55e4c72af8] - (SEMVER-MINOR) http2: implement support for max settings entries (James M Snell) nodejs-private/node-private#204
- [290720d16a] - napi: fix memory corruption vulnerability (Tobias Nießen) nodejs-private/node-private#195
- [94571c1001] - tls: emit session after verifying certificate (Fedor Indutny) nodejs-private/node-private#200
- [1658cf9ee6] - tools: update certdata.txt (AshCripps) #33682

Notable Changes
Track function calls with assert.CallTracker (experimental)
assert.CallTracker is a new experimental API that allows to track and later
verify the number of times a function was called. This works by creating a
CallTracker object and using its calls method to create wrapper functions
that will count each time they are called. Then the verify method can be used
to assert that the expected number of calls happened:
const assert = require('assert');

const tracker = new assert.CallTracker();

function func() {}
// callsfunc() must be called exactly twice before tracker.verify().
const callsfunc = tracker.calls(func, 2);
callsfunc();
callsfunc();

function otherFunc() {}
// The second parameter defaults to `1`.
const callsotherFunc = tracker.calls(otherFunc);
callsotherFunc();

// Calls tracker.verify() and verifies if all tracker.calls() functions have
// been called the right number of times.
process.on('exit', () => {
tracker.verify();
});
Additionally, tracker.report() will return an array which contains information
about the errors, if there are any:
const assert = require('assert');

const tracker = new assert.CallTracker();

function func() {}
const callsfunc = tracker.calls(func);

console.log(tracker.report());
/*
[
{
message: 'Expected the func function to be executed 1 time(s) but was executed 0 time(s).',
actual: 0,
expected: 1,
operator: 'func',
stack: Error
...
}
]
*/
Contributed by ConorDavenport - #31982.
Console groupIndentation option
The Console constructor (require('console').Console) now supports different group indentations.
This is useful in case you want different grouping width than 2 spaces.
const { Console } = require('console');
const customConsole = new Console({
stdout: process.stdout,
stderr: process.stderr,
groupIndentation: 10
});

customConsole.log('foo');
// 'foo'
customConsole.group();
customConsole.log('foo');
// 'foo'
Contributed by rickyes - #32964.
Commits
Semver-minor commits
- [c87ed21fdf] - (SEMVER-MINOR) assert: port common.mustCall() to assert (ConorDavenport) #31982
- [c49e3ea20c] - (SEMVER-MINOR) console: support console constructor groupIndentation option (rickyes) #32964
- [bc9e413dae] - (SEMVER-MINOR) worker: add stack size resource limit option (Anna Henningsen) #33085
Semver-patch commits
- [f62d92b900] - build: add --error-on-warn configure flag (Daniel Bevenius) #32685
- [db293c47dd] - cluster: fix error on worker disconnect/destroy (Santiago Gimeno) #32793
- [83e165bf88] - crypto: check DiffieHellman p and g params (Ben Noordhuis) #32739
- [e07cca6af6] - crypto: generator must be int32 in DiffieHellman() (Ben Noordhuis) #32739
- [637442fec9] - crypto: key size must be int32 in DiffieHellman() (Ben Noordhuis) #32739
- [c5a4534d5c] - deps: V8: backport e29c62b74854 (Anna Henningsen) #33125
- [8325c29e92] - deps: update to uvwasi 0.0.8 (Colin Ihrig) #33078
- [2174159598] - esm: improve commonjs hint on module not found (Daniele Belardi) #31906
- [74b0e8c3a8] - http: ensure client request emits close (Robert Nagy) #33178
- [a4ec01c55b] - http: simplify sending header (Robert Nagy) #33200
- [451993ea94] - http: set default timeout in agent keepSocketAlive (Owen Smith) #33127
- [3cb1713a59] - http2,doc: minor fixes (Alba Mendez) #28044
- [eab4be1b93] - lib: cosmetic change to builtinLibs list for maintainability (James M Snell) #33106
- [542da430ff] - lib: fix validateport error message when allowZero is false (rickyes) #32861
- [5eccf1e9ad] - module: no type module resolver side effects (Guy Bedford) #33086
- [466213d726] - n-api: simplify uv_idle wrangling (Ben Noordhuis) #32997
- [ed45b51642] - path: fix comment grammar (thecodrr) #32942
- [bb2d2f6e0e] - src: remove unused v8 Message namespace (Adrian Estrada) #33180
- [de643bc325] - src: use unique_ptr for CachedData in ContextifyScript::New (Anna Henningsen) #33113
- [f61928ba35] - src: return undefined when validation err == 0 (James M Snell) #33107
- [f4e5ab14da] - src: crypto::UseSNIContext to use BaseObjectP