Notable Changes The following CVEs are fixed in this release: CVE-2023-23918 : Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 : Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23936 ... more
Notable Changes The following CVEs are fixed in this release: CVE-2023-23918 : Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 : Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23920 ... more
Notable Changes The following CVEs are fixed in this release: CVE-2023-23918 : Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920 : Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) ... more
Notable Changes The following CVEs are fixed in this release: CVE-2023-23919 : OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918 : Experimental Policies bypass via process.mainModule.require (High) CVE-2023-23920 : Insecure loading of ... more
Pre-release announce Summary The Node.js project will release new versions of the 14.x, 16.x, 18.x and 19.x releases lines on or shortly after, Tuesday February 14 2023 in order to address: 2 low severity issues. 2 medium severity issues. 1 high severity ... more
Notable changes Updated npm to 9.3.1 Based on the list of guidelines we've established on integrating npm and node , here is a grouped list of the breaking changes with the reasoning as to why they fit within the guidelines linked above. Note that all ... more
Notable changes ESM: Leverage loaders when resolving subsequent loaders Loaders now apply to subsequent loaders, for example: --experimental-loader ts-node --experimental-loader loader-written-in-typescript . Upgrade npm to 9.4.0 Added --install-strategy=linked ... more
Notable changes Add support for externally shared js builtins By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build ... more
Summary The vulnerability in the OpenSSL Security Advisory of Dec 13 2022 do not affect any active Node.js release lines. Analysis Our assessment of the security advisory is: X.509 Policy Constraints Double Locking (CVE-2022-3996) Node.js doesn't call ... more
Notable Changes Updated npm to 9.2.0 Based on the list of guidelines we've established on integrating npm and node , here is a grouped list of the breaking changes with the reasoning as to why they fit within the guidelines linked above. Note that all ... more