OpenSSL security releases do not require Node.js security releases

Summary The OpenSSL Security releases of September 10th, 2019 do not affect Node.js. Analysis Our assessment of the security advisory is: ECDSA remote timing attack (CVE-2019-1547) Not affected. Node supports only named curves for ECDSA signing. Fork ... more

OpenSSL security releases may require Node.js security releases

Summary The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL. Please read on for full details. OpenSSL The OpenSSL project announced this week that they ... more

Node v12.10.0 (Current)

Notable changes deps : Update npm to 6.10.3 (isaacs) #29023 fs : Add recursive option to rmdir() (cjihrig) #29168 Allow passing true to emitClose option (Giorgos Ntemiris) #29212 Add *timeNs properties to BigInt Stats objects (Joyee Cheung) #21387 net ... more

Node v12.9.1 (Current)

Notable changes This release fixes two regressions in the http module: Fixes an event listener leak in the HTTP client. This resulted in lots of warnings during npm/yarn installs (Robert Nagy) #29245. Fixes a regression preventing the 'end' event from ... more

Node v12.9.0 (Current)

Notable changes crypto : Added an oaepHash option to asymmetric encryption which allows users to specify a hash function when using OAEP padding (Tobias Nießen) #28335. deps : Updated V8 to 7.6.303.29 (Michaël Zasso) #28955. Improves the performance ... more

Node v10.16.3 (LTS)

Notable changes This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md ... more

Node v8.16.1 (LTS)

Notable changes This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md ... more

Node v12.8.1 (Current)

Notable changes This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md ... more

August 2019 Security Releases

Summary The Node.js project will release new versions of all supported release lines on, or shortly after, Thursday, August 15th, 2019 UTC. These releases will incorporate security fixes to HTTP/2 Denial of Service vulnerabilities in Node.js, the highest ... more

Node v10.16.2 (LTS)

Notable changes This release patches a regression in the OpenSSL upgrade to 1.1.1c that causes intermittent hangs in machines that have low entropy. Commits [ 894a9dd230 ] - deps : cherry-pick c19c5a6 from openssl upstream (Ali Ijaz Sheikh) #28983 Windows ... more

Node v12.8.0 (Current)

Notable changes assert : Legacy mode deprecation ( DEP0089 ) is revoked (Colin Ihrig) #28892 crypto : The outputLength option is added to crypto.createHash (Tobias Nießen) #28805 The maxmem range is increased from 32 to 53 bits (Tobias Nießen) #28799 ... more

Node v10.16.1 (LTS)

Notable changes deps : upgrade openssl sources to 1.1.1c (Sam Roberts) #28212 stream : do not unconditionally call \_read() on resume() (Anna Henningsen) #26965 worker : fix nullptr deref after MessagePort deser failure (Anna Henningsen) #25076 Commits ... more

Node v12.7.0 (Current)

Notable changes deps : Updated nghttp2 to 1.39.1 (gengjiawen) #28448. Updated npm to 6.10.0 (isaacs) #28525. esm : Implemented experimental "pkg-exports" proposal. A new "exports" field can be added to a module's package.json file ... more

Node v12.6.0 (Current)

Notable changes build : Experimental support for building Node.js on MIPS architecture is back #27992. child_process : The promisified versions of child_process.exec and child_process.execFile now both return a Promise which has the child instance attached ... more

Node v12.5.0 (Current)

Notable changes build : The startup time is reduced by enabling V8 snapshots by default #28181 deps : Updated V8 to 7.5.288.22 #27375 The numeric separator feature is now enabled by default Updated OpenSSL to 1.1.1c #28211 inspector : The --inspect-publish-uid ... more

Node v12.4.0 (Current)

Notable changes doc : The JSON variant of the API documentation is no longer experimental (Rich Trott) #27842. esm : JSON module support is always enabled under --experimental-modules . The --experimental-json-modules flag has been removed (Myles Borins) ... more

Node v10.16.0 (LTS)

Notable Changes deps : update ICU to 64.2 (Ujjwal Sharma) #27361 upgrade npm to 6.9.0 (Kat Marchán) #26244 upgrade openssl sources to 1.1.1b (Sam Roberts) #26327 upgrade to libuv 1.28.0 (cjihrig) #27241 events : add once method to use promises with EventEmitter ... more

Node v12.3.1 (Current)

Notable changes deps : Fix handling of +0/-0 when constant field tracking is enabled (Michaël Zasso) #27792 Fix os.freemem() and os.totalmem correctness (cjihrig) #27718 src : Fix v12.3.0 regression that prevents native addons from compiling #27804 Commits ... more

Node v12.3.0 (Current)

Notable changes esm : Added the --experimental-wasm-modules flag to support WebAssembly modules (Myles Borins & Guy Bedford) #27659 process : Log errors using util.inspect in case of fatal exceptions (Ruben Bridgewater) #27243 repl : Add process.on('uncaughtException') ... more

Node v12.2.0 (Current)

Notable changes deps : Updated llhttp to 1.1.3. This fixes a bug that made Node.js' HTTP parser refuse any request URL that contained the "|" (vertical bar) character (Fedor Indutny) #27595. tls : Added an enableTrace() method to TLSSocket ... more

Node v11.15.0 (Current)

Notable changes deps : add s390 asm rules for OpenSSL-1.1.1 (Shigeki Ohtsu) #19794 src : add .code and SSL specific error properties (Sam Roberts) #25093 tls : add --tls-min-v1.2 CLI switch (Sam Roberts) #26951 supported shared openssl 1.1.0 (Sam Roberts) ... more

Node v12.1.0 (Current)

Notable changes intl : Update ICU to 64.2. This adds support for Japanese Era (Reiwa) (Ujjwal Sharma) #27361. Fixes a bug in ICU that affected Node.js 12.0.0 in the case where new Date().toLocaleString() was called with a non-default locale (Steven R. ... more

Node v12.0.0 (Current)

Notable Changes assert : validate required arguments (Ruben Bridgewater) #26641 adjust loose assertions (Ruben Bridgewater) #25008 async_hooks : remove deprecated emitBefore and emitAfter (Matteo Collina) #26530 remove promise object from resource (Andreas ... more

Node v8.16.0 (LTS)

Notable Changes n-api : add API for asynchronous functions (Gabriel Schulhof) #17887 mark thread-safe function as stable (Gabriel Schulhof) #25556 Commits [ 705935d620 ] - assert : fix backport regression (Ruben Bridgewater) #27202 [ c07ba9681f ] - build ... more

Node v11.14.0 (Current)

Notable changes child_process : doc deprecate ChildProcess._channel (cjihrig) #26982 deps : update nghttp2 to 1.37.0 (gengjiawen) #26990 dns : make dns.promises enumerable (cjihrig) #26592 remove dns.promises experimental warning (cjihrig) #26592 fs ... more

Node v6.17.1 (LTS)

Node 6 is due to go End-of-Life on 2019-04-30 - see Release Schedule. Notable Changes http : fix error check in Execute() (Brian White) #25939 Commits [ c9d21a0c10 ] - build : set -blibpath: for AIX (Richard Lau) #25447 [ 9ba5fd6bad ] - build : only ... more

Node v11.13.0 (Current)

Notable Changes crypto Allow deriving public from private keys (Tobias Nießen) #26278. events Added a once function to use EventEmitter with promises (Matteo Collina) #26078. tty Added a hasColors method to WriteStream (Ruben Bridgewater) #26247. Added ... more

Node v11.12.0 (Current)

Notable Changes bootstrap : Add experimental --frozen-intrinsics flag (Guy Bedford) #25685 build : Enable v8's siphash for hash seed creation (Rod Vagg) #26367 deps : Upgrade openssl to 1.1.1b (Sam Roberts) #26327 process : Make process[Symbol.toStringTag] ... more

Node v11.11.0 (Current)

Notable Changes n-api : Implement date object (Jarrod Connolly) #25917 util : Add compact depth mode for util.inspect() (Ruben Bridgewater) #26269 worker : Improve integration with native addons (Anna Henningsen) #26175 MessagePort.prototype.onmessage ... more

Node v10.15.3 (LTS)

Notable Changes doc add antsmartian to collaborators (Anto Aravinth) #24655 http fix error check in Execute() (Brian White) #25863 stream fix end-of-stream for HTTP/2 (Anna Henningsen) #24926 Commits [ 732088dd44 ] - assert : fix loose deepEqual map ... more