Node.js 10: alte Versionen herunterladen

This is a security release.
Notable Changes
Vulerabilties fixed:
- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)
- This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
- Impacts:
- All versions of the 14.x, 12.x and 10.x releases lines
Commits
- [5e526b96ce] - deps: upgrade npm to 6.14.12 (Ruy Adorno) #37918
- [781cb6df5c] - deps: update archs files for OpenSSL-1.1.1k (Tobias Nießen) #37940
- [5db0a05a90] - deps: upgrade openssl sources to 1.1.1k (Tobias Nießen) #37940

This is a security release.
Notable changes
Vulnerabilities fixed:
- CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
- Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
- CVE-2021-22884: DNS rebinding in --inspect
- Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
- CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt
Commits
- [0afcb4f6bb] - deps: update archs files for OpenSSL-1.1.1j (Daniel Bevenius) #37415
- [447be941cd] - deps: upgrade openssl sources to 1.1.1j (Daniel Bevenius) #37415
- [3f2e9dc40c] - (SEMVER-MINOR) http2: add unknownProtocol timeout (Daniel Bevenius) nodejs-private/node-private#246
- [d1cf6a9b0f] - src: drop localhost6 as allowed host for inspector (Matteo Collina) nodejs-private/node-private#244

Notable changes
The update to npm 6.14.11 has been relanded so that npm correctly reports its version.
Commits
- [953a85035d] - crypto: fix crash when calling digest after piping (Tobias Nießen) #28251
- [fe2c98003e] - deps: upgrade npm to 6.14.11 (Ruy Adorno) #37173
- [7b7fb43b8a] - Revert "deps: upgrade npm to 6.14.11" (Richard Lau) #37278
- [1c6fbd6ffe] - test: add test that verifies crypto stream pipeline (Evan Lucas) #37009

Notable changes
Release keys have been synchronized with the main branch.
- deps:
- upgrade npm to 6.14.11 (Darcy Clarke) #36838
Commits
- [cc6b69557a] - deps: upgrade npm to 6.14.11 (Darcy Clarke) #36838
- [aefb66528a] - doc: update contact information for @BethGriggs (Beth Griggs) #35451
- [08931481d8] - doc: update contact information for richardlau (Richard Lau) #35450
- [bc0617f4ea] - doc: update release key for Danielle Adams (Danielle Adams) #36793
- [d7c09fcfd3] - doc: add release key for Danielle Adams (Danielle Adams) #35545
- [ac49d415b0] - doc: add release key for Ruy Adorno (Ruy Adorno) #34628
- [b8426ae3ce] - doc: add release key for Richard Lau (Richard Lau) #34397

Notable changes
- deps: upgrade openssl sources to 1.1.1c (Sam Roberts) #28212
- stream: do not unconditionally call \_read() on resume() (Anna Henningsen) #26965
- worker: fix nullptr deref after MessagePort deser failure (Anna Henningsen) #25076
Commits
- [65ef26fdcb] - async_hooks: avoid double-destroy HTTPParser (Gerhard Stoebich) #27477
- [8f5d6cf5f5] - deps: update archs files for OpenSSL-1.1.1c (Sam Roberts) #28212
- [9e62852724] - deps: upgrade openssl sources to 1.1.1c (Sam Roberts) #28212
- [c59e0c256d] - deps: updated openssl upgrade instructions (Sam Roberts) #28212
- [609d2b9ea4] - deps: V8: backport f27ac28 (Michaël Zasso) #28061
- [8f780e8f99] - deps: cherry-pick 88f8fe1 from upstream V8 (Yang Guo) #24514
- [ad588eb5fc] - doc: adjust TOC margins (Roman Reiss) #28075
- [b3d8a1b1d0] - doc: add missing changes entry (Ruben Bridgewater) #24758
- [819a647d8f] - esm: fix esm load bug (ZYSzys) #25491
- [f34bb968c4] - process: make stdout and stderr emit 'close' on destroy (Matteo Collina) #26691
- [0339fba1bb] - src: handle empty Maybe in uv binding initialize (Anna Henningsen) #25079
- [f9e8e8856a] - src: fix Get() usage in tls_wrap.cc (cjihrig) #24060
- [b689008dea] - src: in-source comments and minor TLS cleanups (Sam Roberts) #25713
- [76af23a32b] - src: remove internalBinding('config').warningFile (Joyee Cheung) #24959
- [b7dbc1c537] - src: fix warning in cares_wrap.cc (cjihrig) #25230
- [a8f78f02cb] - src: fulfill Maybe contract in InlineDecoder (Anna Henningsen) #25140
- [0dee607409] - src: extract common Bind method (Jon Moss) #22315
- [08a32fbf57] - src: elevate v8 namespaces for node_process.cc (Jayasankar) #24578
- [f3841c6750] - stream: convert existing buffer when calling .setEncoding (Anna Henningsen) #27936
- [274b97c4ea] - stream: do not unconditionally call \_read() on resume() (Anna Henningsen) #26965
- [044e753aaf] - stream: make _read() be called indefinitely if the user wants so (Matteo Collina) #26135
- [f332265cda] - test: remove util.inherits() usage (ZYSzys) #25245
- [ada0ed55d1] - test: fix pty test hangs on aix (Ben Noordhuis) #28600
- [2ae99160e5] - test: skip stringbytes-external-exceed-max on AIX (Sam Roberts) #28516
- [39637cb95f] - test: skip tests related to CI failures on AIX (Sam Roberts) #28469
- [35be08a16f] - test: clean up build files (Gabriel Schulhof) #28297
- [cc3ca08046] - test: clearing require cache crashes esm loader (Antoine du HAMEL) #25491
- [75052cadaa] - tls: add debugging to native TLS code (Anna Henningsen) #26843
- [99dad28ebf] - tls: add CHECK for impossible condition (Anna Henningsen) #26843
- [5ffe04753e] - tls: renegotiate should take care of its own state (Sam Roberts) #25997
- [4a607fab49] - tools: replace rollup with ncc (Rich Trott) #24813
- [14090b59fc] - worker: fix nullptr deref after MessagePort deser failure (Anna Henningsen) #25076