Node.js v21.7.3, v20.12.2 and v18.20.2 released!

[NewsBot]

Node.js v21.7.3, v20.12.2 and v18.20.2 has been released.

This is a security release.

Notable Changes

• CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

• [9095c914ed] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#562

Link: https://github.com/nodejs/node/releases/tag/v21.7.3

This is a security release.

Notable Changes

• CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

• [69ffc6d50d] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#563

Link: Release 2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

• CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

• [6627222409] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#564

Link: Release 2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @RafaelGSS · nodejs/node · GitHub