ही जुनी आवृत्ती आहे. नवीनतम आवृत्ती 15.14.0 आहे. Node.js 15 15.14.0 · रिलीज:
इन्स्टॉलर फाइल्स 15.5.1
| आर्किटेक्चर | प्रकार | कोणासाठी | फाइल आकार | डाउनलोड | SHA256 |
|---|---|---|---|---|---|
| 64-बिट | MSI | सर्व युजर | — | nodejs.org | VirusTotal |
| 64-बिट | ZIP → पोर्टेबल | — | — | nodejs.org | VirusTotal |
| 32-बिट | MSI | सर्व युजर | — | nodejs.org | VirusTotal |
| 32-बिट | ZIP → पोर्टेबल | — | — | nodejs.org | VirusTotal |
लिंक आणि SHA256 हे Windows Package Manager च्या कम्युनिटी मॅनिफेस्टमधून घेतले आहेत. फाइल चालवण्यापूर्वी तिचा हॅश जुळवून पाहा.
रिलीज नोट्स
This is a security release.
Notable changes
Vulnerabilities fixed:
- CVE-2020-8265: use-after-free in TLSWrap (High)
- Affected Node.js versions are vulnerable to a use-after-free bug in
its TLS implementation. When writing to a TLS enabled socket,
nodeStreamBaseWrite calls nodeTLSWrapDoWrite with a freshly
allocated WriteWrap object as first argument. If the DoWrite method
does not return an error, this object is passed back to the caller as
part of a StreamWriteResult structure. This may be exploited to
corrupt memory leading to a Denial of Service or potentially other
exploits.
- CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)
- Affected versions of Node.js allow two copies of a header field in
a http request. For example, two Transfer-Encoding header fields. In
this case Node.js identifies the first header field and ignores the
second. This can lead to HTTP Request Smuggling
(https://cwe.mitre.org/data/definitions/444.html).
Commits
- [c5dbe831b7] - http: add test for http transfer encoding smuggling (Matteo Collina) nodejs-private/node-private#228
- [e0c9a2285c] - http: unset F_CHUNKED on new Transfer-Encoding (Matteo Collina) nodejs-private/node-private#228
- [9834ef85a0] - src: retain pointers to WriteWrap/ShutdownWrap (James M Snell) nodejs-private/node-private#23
