mirror of https://github.com/nodejs/node.git synced 2024-12-01 16:10:02 +01:00

Evan Lucas aae1862385 2016-09-27, Version 6.7.0 (Current)

This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
- Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
CVE-2016-6304 ("OCSP Status Request extension unbounded memory
growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
(Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714
- Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
a crash when using CRLs, CVE-2016-7052.
(Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786
- Remove support for loading dynamic third-party engine modules.
An attacker may be able to hide malicious code to be inserted
into Node.js at runtime by masquerading as one of the dynamic
engine modules. Originally reported by Ahmed Zaki (Skype).
(Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
* http: CVE-2016-5325 - Properly validate for allowable characters in
the `reason` argument in `ServerResponse#writeHead()`. Fixes a
possible response splitting attack vector. This introduces a new
case where `throw` may occur when configuring HTTP responses, users
should already be adopting try/catch here. Originally reported
independently by Evan Lucas and Romain Gaucher.
(Evan Lucas) https://github.com/nodejs/node-private/pull/60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
`Buffer.concat()` while providing a `totalLength` parameter that
exceeds the total length of the original `Buffer` objects being
concatenated.
(Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64
* src: Fix regression where passing an empty password and/or salt to
crypto.pbkdf2() would cause a fatal error
(Rich Trott) https://github.com/nodejs/node/pull/8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
check whereby a TLS server may be able to serve an invalid wildcard
certificate for its hostname due to improper validation of `*.` in the
wildcard string. Originally reported by Alexander Minozhenko and
James Bunton (Atlassian).
(Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
* v8: Fix regression where a regex on a frozen object was broken
(Myles Borins) https://github.com/nodejs/node/pull/8673

2016-09-27 19:45:55 -05:00

54 KiB

Raw Blame History

Node.js Changelog

To make the changelog easier to both use and manage, it has been split into multiple files organized according to significant major and minor Node.js release lines.

Select a Node.js version below to view the changelog history:

Please use the following table to find the changelog for a specific Node.js release.

v6^Current	v5	v4^LTS	v0.12^LTS	v0.10^LTS
6.7.0 6.6.0 6.5.0 6.4.0 6.3.1 6.3.0 6.2.2 6.2.1 6.2.0 6.1.0 6.0.0	5.11.1 5.11.0 5.10.1 5.10.0 5.9.1 5.9.0 5.8.0 5.7.1 5.7.0 5.6.0 5.5.0 5.4.1 5.4.0 5.3.0 5.2.0 5.1.1 5.1.0 5.0.0	4.6.0 4.5.0 4.4.7 4.4.6 4.4.5 4.4.4 4.4.3 4.4.2 4.4.1 4.4.0 4.3.2 4.3.1 4.3.0 4.2.6 4.2.5 4.2.4 4.2.3 4.2.2 4.2.1 4.2.0 4.1.2 4.1.1 4.1.0 4.0.0	0.12.16 0.12.15 0.12.14 0.12.13 0.12.12 0.12.11 0.12.10 0.12.9 0.12.8 0.12.7 0.12.6 0.12.5 0.12.4 0.12.3 0.12.2 0.12.1 0.12.0	0.10.47 0.10.46 0.10.45 0.10.44 0.10.43 0.10.42 0.10.41 0.10.40 0.10.39 0.10.38 0.10.37 0.10.36 0.10.35 0.10.34 0.10.33 0.10.32 0.10.31 0.10.30 0.10.29 0.10.28 0.10.27	0.10.26 0.10.25 0.10.24 0.10.23 0.10.22 0.10.21 0.10.20 0.10.19 0.10.18 0.10.17 0.10.16 0.10.15 0.10.14 0.10.13 0.10.12 0.10.11 0.10.10 0.10.9	0.10.8 0.10.7 0.10.6 0.10.5 0.10.4 0.10.3 0.10.2 0.10.1 0.10.0

Notes

Release streams marked with LTS are currently covered by the Node.js Long Term Support plan.
Release versions displayed in bold text represent the most recent actively supported release.