Node.js v16.4.1, v14.17.2 and v12.22.2 released!

[NewsBot]

Node.js v16.4.1, v14.17.2 and v12.22.2 has been released.

This is a security release.

Notable Changes

Vulnerabilities fixed:

• CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
  • Node.js is vulnerable to out-of-bounds read in libuv’s uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node’s dns module’s lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
• *CVE-2021-22921…

Link: Release 2021-07-01, Version 16.4.1 (Current), @BethGriggs · nodejs/node · GitHub

This is a security release.

Notable Changes

Vulnerabilities fixed:

• CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
  • Node.js is vulnerable to out-of-bounds read in libuv’s uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node’s dns module’s lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
• *CVE-2021-22921…

Link: Release 2021-07-01, Version 14.17.2 'Fermium' (LTS), @richardlau · nodejs/node · GitHub

This is a security release.

Notable Changes

Vulnerabilities fixed:

• CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
  • Node.js is vulnerable to out-of-bounds read in libuv’s uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node’s dns module’s lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
• *CVE-2021-22921…

Link: Release 2021-07-01, Version 12.22.2 'Erbium' (LTS), @richardlau · nodejs/node · GitHub

[bot]

Corresponding tweet for this thread:

Devtalk

Share link for this tweet.