이전 버전입니다. 현재 최신 버전은 18.20.8입니다. Node.js 18 18.20.8 · 출시일:
설치 파일 18.16.1
| 아키텍처 | 형식 | 설치 범위 | 파일 크기 | 다운로드 | SHA256 |
|---|---|---|---|---|---|
| 64비트 | MSI | 모든 사용자 | — | nodejs.org | VirusTotal |
| 64비트 | ZIP → 포터블 | — | — | nodejs.org | VirusTotal |
| 32비트 | MSI | 모든 사용자 | — | nodejs.org | VirusTotal |
| 32비트 | ZIP → 포터블 | — | — | nodejs.org | VirusTotal |
링크와 SHA256은 Windows 패키지 관리자 커뮤니티 매니페스트에서 가져왔습니다. 실행하기 전에 다운로드한 파일의 해시를 비교해 보십시오.
릴리스 노트
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 28th March.
- OpenSSL security advisory 20th April.
- OpenSSL security advisory 30th May
- c-ares vulnerabilities:
- GHSA-9g78-jv2r-p7vc
- GHSA-8r8p-23f3-64c2
- GHSA-54xr-f67r-4pc4
- GHSA-x6mf-cxr9-8q6v
More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.
Commits
- [bf3e2c8928] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
- [70f9449072] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
- [35d4efb57b] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
- [392dfedc77] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
- [46cd5fe38b] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
- [7e3d2d85c2] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
- [4ff6ba050a] - http: disable request smuggling via rempty headers (Paolo Insogna) nodejs-private/node-private#428
- [ab269129a6] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
- [925e8f5619] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
- [d6fae8e47e] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851
