Node.js v20.5.1, v18.17.1 and v16.20.2 released!

[NewsBot]

Node.js v20.5.1, v18.17.1 and v16.20.2 has been released.

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
• CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• CVE-2023-32005: fs.statfs can bypass the permission model (L…

Link: Release 2023-08-09, Version 20.5.1 (Current), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 14th July.
  • OpenSSL security advisory 19th July.
  • OpenSSL security advisory 31st July

More detailed information on each of the vulnerabilities can be found in [August 20…

Link: Release 2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 14th July.
  • OpenSSL security advisory 19th July.
  • OpenSSL security advisory 31st July

More detailed information on each of the vulnerabilities can be found in [August 20…

Link: Release 2023-08-09, Version 16.20.2 'Gallium' (LTS), @RafaelGSS · nodejs/node · GitHub