mirror of https://github.com/nodejs/node.git synced 2024-11-21 10:59:27 +00:00

2018-03-28, Version 9.10.0 (Current)

This is a security release. All Node.js users should consult the
security release summary at:

https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

* CVE-2018-7158
* CVE-2018-7159
* CVE-2018-7160

Notable changes:

* Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that
  are known to impact Node.js.
* **Fix for inspector DNS rebinding vulnerability (CVE-2018-7160)**:
  A malicious website could use a DNS rebinding attack to trick a web
  browser to bypass same-origin-policy checks and allow HTTP
  connections to localhost or to hosts on the local network,
  potentially to an open inspector port as a debugger, therefore
  gaining full code execution access. The inspector now only allows
  connections that have a browser `Host` value of `localhost` or
  `localhost6`.
* **Fix for `'path'` module regular expression denial of service
  (CVE-2018-7158)**: A regular expression used for parsing POSIX an
  Windows paths could be used to cause a denial of service if an
  attacker were able to have a specially crafted path string passed
  through one of the impacted `'path'` module functions.
* **Reject spaces in HTTP `Content-Length` header values
  (CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside
  `Content-Length` header values. Such values now lead to rejected
  connections in the same way as non-numeric values.
* **Update root certificates**: 5 additional root certificates have
  been added to the Node.js binary and 30 have been removed.

* cluster:
  - Add support for `NODE_OPTIONS="--inspect"` (Sameer Srivastava)
    https://github.com/nodejs/node/pull/19165
* crypto:
  - Expose the public key of a certificate (Hannes Magnusson)
    https://github.com/nodejs/node/pull/17690
* n-api:
  - Add `napi_fatal_exception` to trigger an `uncaughtException` in
    JavaScript (Mathias Buus)
    https://github.com/nodejs/node/pull/19337
* path:
  - Fix regression in `posix.normalize` (Michaël Zasso)
    https://github.com/nodejs/node/pull/19520
* stream:
  - Improve stream creation performance (Brian White)
    https://github.com/nodejs/node/pull/19401
* Added new collaborators
  - [BethGriggs](https://github.com/BethGriggs) Beth Griggs

PR-URL: https://github.com/nodejs-private/node-private/pull/111

2018-03-28 12:21:10 -04:00

54 KiB

Raw Blame History

Node.js Changelog

To make the changelog easier to both use and manage, it has been split into multiple files organized according to significant major and minor Node.js release lines.

Select a Node.js version below to view the changelog history:

Please use the following table to find the changelog for a specific Node.js release.

9^Current	8^LTS	6^LTS	4^LTS
9.10.0 9.9.0 9.8.0 9.7.1 9.7.0 9.6.1 9.6.0 9.5.0 9.4.0 9.3.0 9.2.1 9.2.0 9.1.0 9.0.0	8.11.0 8.10.0 8.9.4 8.9.3 8.9.2 8.9.1 8.9.0 8.8.1 8.8.0 8.7.0 8.6.0 8.5.0 8.4.0 8.3.0 8.2.1 8.2.0 8.1.4 8.1.3 8.1.2 8.1.1 8.1.0 8.0.0	6.14.0 6.13.1 6.13.0 6.12.3 6.12.2 6.12.1 6.12.0 6.11.5 6.11.4 6.11.3 6.11.2 6.11.1 6.11.0 6.10.3 6.10.2 6.10.1 6.10.0 6.9.5 6.9.4 6.9.3 6.9.2 6.9.1 6.9.0 6.8.1 6.8.0 6.7.0 6.6.0 6.5.0 6.4.0 6.3.1 6.3.0 6.2.2 6.2.1 6.2.0 6.1.0 6.0.0	4.9.0 4.8.7 4.8.6 4.8.5 4.8.4 4.8.3 4.8.2 4.8.1 4.8.0 4.7.3 4.7.2 4.7.1 4.7.0 4.6.2 4.6.1 4.6.0 4.5.0 4.4.7 4.4.6 4.4.5 4.4.4 4.4.3 4.4.2 4.4.1 4.4.0 4.3.2 4.3.1 4.3.0 4.2.6 4.2.5 4.2.4 4.2.3 4.2.2 4.2.1 4.2.0 4.1.2 4.1.1 4.1.0 4.0.0

Notes

Release streams marked with LTS are currently covered by the Node.js Long Term Support plan.
Release versions displayed in bold text represent the most recent actively supported release.