Node.js v12.22.7, v14.18.1 and v16.11.1 released!

[NewsBot]

Node.js v12.22.7, v14.18.1 and v16.11.1 has been released.

This is a security release.

Notable changes

• CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
• CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  • …

Link: Release 2021-10-12, Version 12.22.7 'Erbium' (LTS), @danielleadams · nodejs/node · GitHub

This is a security release.

Notable changes

• CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
• CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  • …

Link: Release 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams · nodejs/node · GitHub

This is a security release.

Notable changes

• CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
• CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  • …

Link: Release 2021-10-12, Version 16.11.1 (Current), @danielleadams · nodejs/node · GitHub

[bot]

Corresponding tweet for this thread:

Devtalk

Share link for this tweet.