Skip to content

Releases: nodejs/node

Release list

2018-12-03, Version 6.15.1 'Boron' (LTS), @rvagg

2018-12-03, Version 6.15.1 'Boron' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:55
v6.15.1
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
cde6450

Notable Changes

This is a patch release to address a bad backport of the fix for "Slowloris HTTP Denial of Service" (CVE-2018-12122). Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session, resulting in prematurely disconnected sockets.

Commits

  • [5d9005c359] - http: fix backport of Slowloris headers (Matteo Collina) #24796
Loading

2018-11-29, Version 10.14.1 'Dubnium' (LTS), @MylesBorins

2018-11-29, Version 10.14.1 'Dubnium' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:54
v10.14.1
d3dbe3a

Notable Changes

  • win/msi: Revert changes to installer causing issues on Windows systems.

Commits

  • [5d17bf1e13] - win: add prompt to tools installation script (João Reis) #23987
  • [589f0d2192] - win: clarify Boxstarter behavior on install tools (Rob Reynolds) #23987
  • [9e293c1328] - Revert "win,msi: install tools for native modules" (Refael Ackermann) #24344
Loading

2018-11-27, Version 10.14.0 'Dubnium' (LTS), @rvagg

2018-11-27, Version 10.14.0 'Dubnium' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:53
v10.14.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
b710313

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735)

Notable Changes

  • deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 8.14.0 'Carbon' (LTS), @rvagg

2018-11-27, Version 8.14.0 'Carbon' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:52
v8.14.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
39716a8

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • Node.js: HTTP request splitting (CVE-2018-12116)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

Notable Changes

  • deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
    • Two-byte characters are now strictly disallowed for the path option in HTTP client requests. Paths containing characters outside of the range \u0021 - \u00ff will now be rejected with a TypeError. This behavior can be reverted if necessary by supplying the --security-revert=CVE-2018-12116 command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (Lob), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg

2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:52
v6.15.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
b6589e3

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120)
  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • Node.js: HTTP request splitting (CVE-2018-12116)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

Notable Changes

  • debugger: Backport of nodejs/node#8106 to prevent the debugger from listening on 0.0.0.0. It now defaults to 127.0.0.1. Reported by Ben Noordhuis. (CVE-2018-12120 / Ben Noordhuis).
  • deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
    • Two-byte characters are now strictly disallowed for the path option in HTTP client requests. Paths containing characters outside of the range \u0021 - \u00ff will now be rejected with a TypeError. This behavior can be reverted if necessary by supplying the --security-revert=CVE-2018-12116 command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (Lob), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 11.3.0 (Current), @rvagg

2018-11-27, Version 11.3.0 (Current), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:51
v11.3.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
00fb73a

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735)

Notable Changes

  • deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-20, Version 8.13.0 'Carbon' (LTS), @MylesBorins prepared by @BethGriggs

2018-11-20, Version 8.13.0 'Carbon' (LTS), @MylesBorins prepared by @BethGriggs

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 20 Nov 18:14
v8.13.0
90c7bfa

Notable changes

  • assert:
    • backport some assert commits (Ruben Bridgewater) #23223
  • deps:
    • upgrade to libuv 1.23.2 (cjihrig) #23336
    • V8: cherry-pick 64-bit hash seed commits (Yang Guo) #23274
  • http:
    • added aborted property to request (Robert Nagy) #20094
  • http2:
    • graduate from experimental (James M Snell) #22466

Commits

Read more
Loading

2018-11-15, Version 11.2.0 (Current), @BridgeAR

2018-11-15, Version 11.2.0 (Current), @BridgeAR

Choose a tag to compare

View all tags
@targos targos released this 15 Nov 21:24
v11.2.0
This tag was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.
a19e1ab
This commit was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.

Notable changes

  • deps:
    • A new experimental HTTP parser (llhttp) is now supported. #24059
  • timers:
    • Fixed an issue that could cause setTimeout to stop working as expected. #24322
  • Windows
    • A crashing process will now show the names of stack frames if the node.pdb file is available. #23822
    • Continued effort to improve the installer's new stage that installs
      native build tools. #23987, #24348
    • child_process:
      • On Windows the windowsHide option default was restored to false.
        This means detached child processes and GUI apps will once again
        start in a new window. #24034
  • Added new collaborators:

Commits

  • [685724b53d] - assert: remove unused catch bindings (cjihrig) #24079
  • [bb766ae05a] - async_hooks: add HandleScopes to C++ embedder/addon API (Anna Henningsen) #24285
  • [ad5c9b4463] - benchmark: support more options in startup benchmark (Joyee Cheung) #24220
  • [d0bf8c2259] - benchmark: add dir and withFileTypes option readdir benchmarks (Joyee Cheung) #24125
  • [40b3ad3eb8] - benchmark: remove unused catch bindings (cjihrig) #24079
  • [1f3cb63da3] - bootstrap: remove unused catch bindings (cjihrig) #24079
  • [fcc25f9ee8] - buffer: fix writeUInt16BE range check (Brian White) #24208
  • [e4cd255a85] - buffer: throw exception when creating from non-Node.js Context (Anna Henningsen) #23938
  • [44ebdbb860] - build: fix benchmark tests on CI (Rich Trott) #24307
  • [1c8b4d7c89] - build: disable openssl asm on arm64 for now (Ben Noordhuis) #24270
  • [0c9d86f58c] - build: use BUILDTYPE in bench-addons-build targets (Daniel Bevenius) #24033
  • [70699ee09b] - build: lint commit message in separate Travis job (Richard Lau) #24254
  • [2b282e8f20] - build: move headers out of c++ src section (Daniel Bevenius) #24124
  • [a8008d1517] - build: only try to find node when it's needed by the target (Joyee Cheung) #24115
  • [e4bcb97024] - build: change repo to https protocol in Makefile (mritunjaygoutam12) #24073
  • [7083b96c49] - build: use latest node on travis (cjihrig) #24198
  • [99c2a10f7b] - build: fix Travis non-PR builds (Richard Lau) #24093
  • [3de1c5cadd] - build: do not lint on non-PR Travis builds (Anna Henningsen) #24076
  • [762679efec] - build: make benchmark/napi all prereq order-only (Daniel Bevenius) #23951
  • [4651cd721d] - build: add -Werror=undefined-inline to clang builds (Refael Ackermann) #23961
  • [e7133f1e7c] - build: configure default v8_optimized_debug (Refael Ackermann) #23704
  • [26c19889a8] - build,meta: don't fail Travis for commit message (Refael Ackermann) #23739
  • [838fb550c6] - build,tools: update make-v8.sh for s390x (Refael Ackermann) #23839
  • [c07cce368a] - Revert "child_process: change windowsHide default to true" (Rich Trott) #24034
  • [a1c7c1902a] - child_process: allow 'http_parser' monkey patching again (Jimb Esser) #24006
  • [4af63ee5d9] - child_process: handle undefined/null for fork() args (Shobhit Chittora) #22416
  • [a2c13fac94] - console: console.timeLog() using the default label (Marie Terrier) #24286
  • [9e891327b7] - console: cover .assert with single argument (Morgan Roderick) #24188
  • [2b48c7169a] - crypto: put legacy _handle accessors on prototypes (Michaël Zasso) #24269
  • [f669817a5a] - (SEMVER-MINOR) crypto: add support for chacha20-poly1305 for AEAD (chux0519) #24081
  • [ef69e7bcca] - deps: backport 073073b4f1 from upstream V8 (Yang Guo) #24274
  • [a39493f4aa] - deps: cherry-pick b87d408 from upstream V8 (Peter Marshall) #24272
  • [9cefbba5d7] - deps: patch V8 to 7.0.276.38 (Michaël Zasso) #24271
  • [115c57a240] - deps: introduce llhttp (Fedor Indutny) #24059
  • [566399ee31] - deps: patch V8 to 7.0.276.36 (Michaël Zasso) #24109
  • [3e1c53fe37] - deps: cherry-pick 0483e9a from upstream V8 (Joyee Cheung) #24125
  • [6b697d4816] - deps: c-ares float, version number patch (Ben Noordhuis) #23854
  • [07663694b4] - deps: upgrade to c-ares v1.15.0 (Ben Noordhuis) #23854
  • [eaea90b2ee] - deps: remove old c-ares configure files (Ben Noordhuis) #23854
  • [f49b9e9c84] - deps: patch V8 to 7.0.276.35 (Michaël Zasso) #24056
  • [6e4f238344] - deps,v8: cherry-pick dc704497 (Refael Ackermann) #23985
  • [ef8b5b4094] - deps,v8: fix gypfile bug (Refael Ackermann) #23704
  • [a01e829fb0] - doc: document http request.finished boolean (Thomas Watson) #24319
  • [36e4d0c6f0] - doc: document NODE_TLS_REJECT_UNAUTHORIZED (cjihrig) #24289
  • [fbd0b037ec] - doc: clarify issues and pull requests guidance (Rich Trott) #24316
  • [a993a488fa] - doc: fix comma splices in process.md (Rich Trott) #24357
  • [e584cc52fc] - doc: use real protocol names in ALPN example (Sam Roberts) [#24...
Read more
Loading

2018-11-02, Version 11.1.0 (Current), @targos

2018-11-02, Version 11.1.0 (Current), @targos

Choose a tag to compare

View all tags
@targos targos released this 02 Nov 12:37
v11.1.0
This tag was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.
af6d262
This commit was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.

Notable changes

  • deps
  • repl
    • Top-level for-await-of is now supported in the REPL. #23841
  • timers
    • Fixed an issue that could cause timers to enter an infinite loop. #23870

Commits

  • [2c2e2b53ab] - benchmark: fix bench-mkdirp to use recursive option (Klaus Meinhardt) #23699
  • [787e13b41c] - build: expose more openssl categories for addons (Jonathan Cardoso Machado) #23344
  • [b8f3bb107e] - build: add lint-py which uses flake8 (cclauss) #21952
  • [35c3c4ba68] - build: allow for overwriting of use_openssl_def (Shelley Vohr) #23763
  • [5c35d0db47] - build,meta: switch to gcc-4.9 on travis (Refael Ackermann) #23778
  • [141aec9564] - crypto: add SET_INTEGER_CONSANT macro (Daniel Bevenius) #23687
  • [4112a10abe] - crypto: strip unwanted space from openssl version (Sam Roberts) #23678
  • [2cc4f5c923] - deps: patch V8 to 7.0.276.32 (Michaël Zasso) #23851
  • [0312d8b2cd] - deps: fix shim for v8::Value::IntegerValue() (Anna Henningsen) #23898
  • [9011db426e] - (SEMVER-MINOR) deps: move more deprecations to V8_DEPRECATED (Anna Henningsen) #23414
  • [e5b51cc496] - (SEMVER-MINOR) deps: icu 63.1 bump (CLDR 34) (Steven R. Loomis) #23715
  • [ab58439916] - deps: icu: apply workaround patch (Steven R. Loomis) #23764
  • [3b66a8d893] - deps: fix wrong default for v8 handle zapping (Refael Ackermann) #23801
  • [26510fbd8e] - doc: add branding to style guide (Rich Trott) #23967
  • [33053ec8d7] - doc: use Node.js instead of Node (Rich Trott) #23967
  • [ec009f620c] - doc: revise BUILDING.md (Rich Trott) #23966
  • [da494ef889] - doc: clarify fd behaviour with {read,write}File (Sakthipriyan Vairamani (thefourtheye)) #23706
  • [539e1233b0] - doc: moved test instructions to BUILDING.md (Kamat, Trivikram) #23949
  • [cc65fee1d3] - doc: fix typographical issues (Denis McDonald) #23970
  • [ee6b0395f5] - doc: sort markdown refs in errors (Sam Roberts) #23972
  • [ee299c7ef1] - doc: remove "idiomatic choice" from queueMicrotask (Rod Vagg) #23885
  • [147e5d5792] - doc: document HPE_HEADER_OVERFLOW error (Sam Roberts) #23963
  • [24c6a02930] - doc: add documentation for http.IncomingMessage$complete (James M Snell) #23914
  • [82ee6c3e47] - doc: remove mailing list (Rich Trott) #23932
  • [99fffff6e0] - doc: remove notice of dashes in V8 options (Denys Otrishko) #23903
  • [8b5339da14] - doc: rename README section for Release Keys (Rich Trott) #23927
  • [676875195b] - doc: add note about ABI compatibility (Myles Borins) #22237
  • [f01a806276] - doc: add optional callback to socket.end() (Ajido) #23937
  • [64c205d9bc] - doc: make example more clarified in cluster.md (ZYSzys) #23931
  • [748dbf9778] - doc: simplify valid security issue descriptions (Rich Trott) #23881
  • [e241398ef6] - doc: simplify path.basename() on POSIX and Windows (ZYSzys) #23864
  • [49b32af5ab] - doc: document nullptr comparisons in style guide (Anna Henningsen) #23805
  • [0ba49fec12] - doc: remove problematic example from README (Rich Trott) #23817
  • [d808d27120] - doc: use Cookie in request.setHeader() examples (Luigi Pinca) #23707
  • [1baba9b061] - doc: NODE_EXTRA_CA_CERTS is ignored if setuid root (Ben Noordhuis) #23770
  • [dd5afbe05f] - doc: add review suggestions to require() (erickwendel) #23605
  • [db113a24e0] - doc: document and warn if the ICU version is too old (Steven R. Loomis) #23766
  • [c30de85ca5] - doc: move @phillipj to emeriti (Phillip Johnsen) #23790
  • [84fdb1cc0e] - doc: add note about removeListener order (James M Snell) #23762
  • [f4c4b2b41b] - doc: document ACL limitation for fs.access on Windows (James M Snell) #23772
  • [83b776c864] - doc: document that addMembership must be called once in a cluster (James M Snell) #23746
  • [1851cf4f83] - doc, test: document and test vm timeout escapes (James M Snell) #23743
  • [b4b101fed6] - (SEMVER-MINOR) fs: default open/openSync flags argument to 'r' (Ben Noordhuis) #23767
  • [1c5ffb3ec5] - (SEMVER-MINOR) lib: add escapeCodeTimeout as an option to createInterface (Raoof) #19780
  • [1cda41b7da] - lib: migrate from process.binding('config') to getOptions() (Vladimir Ilic) #23588
  • [22cd53791a] - lib: trigger uncaught exception handler for microtasks (Gus Caplan) #23794
  • [97496f0fd9] - n-api: make per-Context-ness of napi\_env explicit (Anna Henningsen) #23689
  • [3e512f1897] - os: fix memory leak in userInfo() (Anna Henningsen) #23893
  • [02f13abde3] - repl: support top-level for-await-of (Shelley Vohr) #23841
  • [86cf01404c] - repl: migrate from process.binding('config') to getOptions() (Jose Bucio) #23684
  • [4a79b2568f] - src: improve StreamBase write throughput ...
Read more
Loading

2018-10-30, Version 10.13.0 'Dubnium' (LTS), @MylesBorins

2018-10-30, Version 10.13.0 'Dubnium' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 02 Nov 15:19
v10.13.0
ab4af08

This release marks the transition of Node.js 10.x into Long Term
Support (LTS) with the codename 'Dubnium'. The 10.x release line
now moves in to "Active LTS" and will remain so until April 2020.
After that time it will move in to "Maintenance" until end of
life in April 2021.

Notable Changes

This release only includes minimal changes necessary to fix known regressions prior to LTS.

Commits

  • [2ba6010082] - buffer: fix crash for invalid index types (Anna Henningsen)
  • [2cd68be69d] - build: spawn make test-ci with -j1 (Refael Ackermann) #23733
  • [1003f4c975] - deps: fix wrong default for v8 handle zapping (Refael Ackermann) #23801
Loading