Nodejs/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-21 10:59:27 +00:00
Code Issues Actions 25 Packages Projects Releases Wiki Activity

2020-09-15, Version 14.11.0 (Current)

Browse Source 
This is a security release.

Notable changes:

Vulnerabilities fixed:

- CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due
  to unfinished HTTP/1.1 requests (Critical).
- CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion
  (High).

PR-URL: https://github.com/nodejs-private/node-private/pull/225
This commit is contained in:
Richard Lau 2020-09-14 16:02:57 -04:00
parent 9ab5c6b96c
commit 8e17383653
No known key found for this signature in database
GPG Key ID: C43CEC45C17AB93C
4 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -30,7 +30,8 @@ release.
</tr>
<tr>
<td valign="top">
<b><a href="doc/changelogs/CHANGELOG_V14.md#14.10.1">14.10.1</a></b><br/>
<b><a href="doc/changelogs/CHANGELOG_V14.md#14.11.0">14.11.0</a></b><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.10.1">14.10.1</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.10.0">14.10.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.9.0">14.9.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.8.0">14.8.0</a><br/>

2
doc/api/http.md
View File

@ -1261,7 +1261,7 @@ Limits maximum incoming headers count. If set to 0, no limit will be applied.
### `server.requestTimeout`
<!-- YAML
added: REPLACEME
added: v14.11.0
-->
* {number} **Default:** `0`

2
doc/api/https.md
View File

@ -115,7 +115,7 @@ See [`http.Server#maxHeadersCount`][].
### `server.requestTimeout`
<!-- YAML
added: REPLACEME
added: v14.11.0
-->
* {number} **Default:** `0`

18
doc/changelogs/CHANGELOG_V14.md
View File

@ -10,6 +10,7 @@
</tr>
<tr>
<td>
<a href="#14.11.0">14.11.0</a><br/>
<a href="#14.10.1">14.10.1</a><br/>
<a href="#14.10.0">14.10.0</a><br/>
<a href="#14.9.0">14.9.0</a><br/>
@ -42,6 +43,23 @@
* [io.js](CHANGELOG_IOJS.md)
* [Archive](CHANGELOG_ARCHIVE.md)
<a id="14.11.0"></a>
## 2020-09-15, Version 14.11.0 (Current), @richardlau
### Notable Changes
This is a security release.
Vulnerabilities fixed:
* **CVE-2020-8251**: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical).
* **CVE-2020-8201**: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).
### Commits
* [[`dd828376a0`](https://github.com/nodejs/node/commit/dd828376a0)] - **deps**: update llhttp to 2.1.2 (Fedor Indutny) [nodejs-private/node-private#215](https://github.com/nodejs-private/node-private/pull/215)
* [[`753f3b247a`](https://github.com/nodejs/node/commit/753f3b247a)] - **http**: add requestTimeout (Matteo Collina, Paolo Insogna, Robert Nagy) [nodejs-private/node-private#208](https://github.com/nodejs-private/node-private/pull/208)
<a id="14.10.1"></a>
## 2020-09-10, Version 14.10.1 (Current), @richardlau