Đây là phiên bản cũ. Phiên bản mới nhất là 21.7.3. Node.js 21 21.7.3 · Ngày phát hành:
Tệp cài đặt 21.6.2
| Kiến trúc | Loại | Phạm vi | Dung lượng | Tải về | SHA256 |
|---|---|---|---|---|---|
| 64-bit | MSI | Tất cả người dùng | — | nodejs.org | VirusTotal |
| ARM64 | MSI | Tất cả người dùng | — | nodejs.org | VirusTotal |
| 32-bit | MSI | Tất cả người dùng | — | nodejs.org | VirusTotal |
Liên kết và mã SHA256 lấy từ manifest cộng đồng của Windows Package Manager. Hãy so sánh mã băm của tệp đã tải trước khi chạy.
Ghi chú phát hành
Notable changes
This is a security release.
Notable changes
- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
- undici version 5.28.3
- libuv version 1.48.0
- OpenSSL version 3.0.13+quic1
Commits
- [8344719369] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
- [d093600ac4] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [6cd930e5e8] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [9590c15d3d] - deps: upgrade libuv to 1.48.0 (Santiago Gimeno) #51698
- [666096298c] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#528
- [a4edd22e30] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497
- [6155a1ffaf] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#518
- [777509495e] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516
- [9d2ac2b3fc] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#538
- [208b3940c7] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
- [fc2454f29c] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#528
- [ef3eea20be] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517
- [8547196964] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#540
