| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
Version 14.21.1 'Fermium' (LTS), @BethGriggs
This is a security release.
Notable changes
The following CVEs are fixed in this release:
* **[CVE-2022-43548](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43548)**: DNS rebinding in --inspect via invalid octal IP address (Medium)
|
|
Version 14.20.1 'Fermium' (LTS)
This is a security release.
Notable changes
The following CVEs are fixed in this release:
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32213: bypass via obs-fold mechanic (Medium)
CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)
|
|
Version 14.20.0 'Fermium' (LTS)
Notable Changes
- (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius)
- deps: upgrade openssl sources to 1.1.1q (RafaelGSS)
|
|
While not strictly true, it's required to avoid pbulk always choosing nodejs18
as the preferred dependency, which is incorrect on platforms where it does not
build (macOS 10.14) and NODE_VERSION_DEFAULT is set to 16.
|
|
Version 14.19.3 'Fermium' (LTS)
Notable Changes
This release updates OpenSSL to 1.1.1o. This update is not being treated as a security release as the issues addressed in OpenSSL 1.1.1o were assessed to not affect Node.js 14. See https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-may2022/ for more information on how the May 2022 OpenSSL releases affects other Node.js release lines.
The list of GPG keys used to sign releases has been synchronized with the main branch.
Version 14.19.2 'Fermium' (LTS)
Notable Changes
doc:
New release key for Bryan English
npm:
Upgrade npm to v6.14.17.
V8:
V8 had a stack overflow issue affecting the vm module, cherry-picking cc9a8a37445e from V8 solves this issue.
Using getHeapSnapshot() was causing a Node.js crash due a V8 issue, this is fixed by backporting 367b0c1e7a32 from V8.
|
|
|
|
Version 14.19.1 'Fermium' (LTS)
This is a security release.
Notable Changes
Update to OpenSSL 1.1.1n, which addresses the following vulnerability:
Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778) More details are available at https://www.openssl.org/news/secadv/20220315.txt
|
