You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: locale/en/blog/vulnerability/december-2019-security-releases.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,21 +52,21 @@ Please note that this will be the final release of the v8.x line as support ends
52
52
53
53
--------------------------------------
54
54
55
-
# Summary
55
+
##Summary
56
56
57
57
The Node.js project will release new versions of all supported release lines on or shortly after Tuesday December 17, 2019 UTC. For versions 8, 10, and 12 the only update to the runtime in these releases will be an updated version of npm addressing the vulnerability announced in https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli. Version 13, while still being a security release, will include all commits that were scheduled to be included in the originally scheduled release.
58
58
59
59
In the meantime, users should update to npm 6.13.4 by following the instructions provided in the npm advisory. As a general rule, avoid running npm in production environments.
60
60
61
-
# Impact
61
+
##Impact
62
62
63
63
All versions of Node.js are vulnerable including the LTS and current releases: Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13.
64
64
65
-
# Release timing
65
+
##Release timing
66
66
67
67
Releases will be available at, or shortly after, Tuesday, December 17, 2019 UTC.
68
68
69
-
# Contact and future updates
69
+
##Contact and future updates
70
70
71
71
The current Node.js security policy can be found at https://nodejs.org/en/security/. Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.
Copy file name to clipboardExpand all lines: locale/en/blog/vulnerability/february-2020-security-releases.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,21 +41,21 @@ Increase the strictness of HTTP header parsing. There are no known vulnerabiliti
41
41
42
42
--------------------------------------
43
43
44
-
# Summary
44
+
##Summary
45
45
46
46
The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, February 4th, 2020.
47
47
48
48
One Critical severity and two High severity issues will be fixed. The release also includes stricter HTTP parsing.
49
49
50
-
# Impact
50
+
##Impact
51
51
52
52
All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
53
53
54
-
# Release timing
54
+
##Release timing
55
55
56
56
Releases will be available at, or shortly after, Tuesday, February 4th, 2020.
57
57
58
-
# Contact and future updates
58
+
##Contact and future updates
59
59
60
60
The current Node.js security policy can be found at https://nodejs.org/en/security/. Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.
# _(Update 11-July-2017)_ Security releases available
20
+
##_(Update 11-July-2017)_ Security releases available
21
21
22
22
## Summary
23
23
Updates are now available for all active Node.js release lines as well as the 7.x line. These include the fix for the high severity vulnerability identified in the initial announcement, one additional lower priority Node.js vulnerability in the 4.x release line, as well as some lower priority fixes for Node.js dependencies across the current release lines.
@@ -79,7 +79,7 @@ The Node.js project will be releasing new versions across all of its active rele
79
79
## Denial of Service Vulnerability
80
80
All current versions of v4.x through to v8.x inclusive are vulnerable to an issue that can be used by an external attacker to cause a denial of service. The severity of this vulnerability is high and users of the affected versions should plan to upgrade when a fix is made available.
Copy file name to clipboardExpand all lines: locale/en/blog/vulnerability/oct-2017-dos.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,24 +47,24 @@ This vulnerability has been assigned CVE-2017-14919.
47
47
48
48
---
49
49
50
-
# Summary
50
+
##Summary
51
51
52
52
The Node.js project will be releasing new versions of 4.x, 6.x, and 8.x the week of the 24th of October to incorporate a security fix.
53
53
54
-
# Denial of Service Vulnerability
54
+
##Denial of Service Vulnerability
55
55
56
56
Versions 4.8.2 and later, 6.10.2 and later, as well as all versions of 8.x are vulnerable to an issue that can be used by an external attacker to cause a denial of service. The severity of this vulnerability is HIGH and users of the affected version should plan to upgrade when a fix is made available.
57
57
58
-
# Impact
58
+
##Impact
59
59
60
60
Versions 4.8.2 and later of Node.js are vulnerable.<br>
61
61
Versions 6.10.2 and later of Node.js are vulnerable.<br>
62
62
Versions 8.x of Node.js are vulnerable.
63
63
64
-
# Release timing
64
+
##Release timing
65
65
Releases will be available at, or shortly after, the 24th of October along with disclosure of the details for the vulnerability in order to allow for complete impact assessment by users.
66
66
67
-
# Contact and future updates
67
+
##Contact and future updates
68
68
69
69
The current Node.js security policy can be found at https://nodejs.org/en/security/.
0 commit comments