Node.js v12.20.1, v10.23.1 and v14.15.4 released!

[NewsBot]

Node.js v12.20.1, v10.23.1 and v14.15.4 has been released.

Notable changes

This is a security release.

Vulnerabilities fixed:

• CVE-2020-8265: use-after-free in TLSWrap (High)
  Affected Node.js versions are vulnerable to a use-after-free bug in its
  TLS implementation. When writing to a TLS enabled socket,
  node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly
  allocated WriteWrap object as first argument. If the DoWrite method does
  not return an error, this object is passed back to the caller as part of
  a StreamWrite…

Link: Release 2021-01-04, Version 12.20.1 'Erbium' (LTS), @richardlau · nodejs/node · GitHub

Notable changes

This is a security release.

Vulnerabilities fixed:

• CVE-2020-8265: use-after-free in TLSWrap (High)
  Affected Node.js versions are vulnerable to a use-after-free bug in its
  TLS implementation. When writing to a TLS enabled socket,
  node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly
  allocated WriteWrap object as first argument. If the DoWrite method does
  not return an error, this object is passed back to the caller as part of
  a StreamWrite…

Link: Release 2021-01-04, Version 10.23.1 'Dubnium' (LTS), @richardlau · nodejs/node · GitHub

This is a security release.

Notable Changes

Vulnerabilities fixed:

• CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)

  • This is a vulnerability in OpenSSL which may be exploited through
    Node.js. You can read more about it in
    https://www.openssl.org/news/secadv/20201208.txt

• CVE-2020-8265: use-after-free in TLSWrap (High)

  • Affected Node.js versions are vulnerable to a use-after-free bug in
    its TLS implementation. When writing to a …

Link: Release 2021-01-04, Version 14.15.4 'Fermium' (LTS), @BethGriggs · nodejs/node · GitHub

[bot]

Corresponding tweet for this thread:

https://twitter.com/dev_talk/status/1346171642809102337

Share link for this tweet.

---

Related portal:

Node.js JavaScript Runtime | Devtalk