Node.js v22.4.1, v20.15.1 and v18.20.4 released!

[NewsBot]

Node.js v22.4.1, v20.15.1 and v18.20.4 has been released.

This is a security release.

Notable Changes

• CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
• CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
• CVE-2024-22018 - fs.lstat bypasses permission model (Low)
• CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
• CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Commits

• [110902ff5e] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
• [0a0de3d491] - lib,permission: support fs.lstat (RafaelGSS)
• [93574335ff] - lib,permission: disable fchmod/fchown when pm enabled (RafaelGSS) [nodejs-private/node-private#584](https://github.com/nodejs-private/node-private/pull/5…

Link: Release 2024-07-08, Version 22.4.1 (Current), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

• CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
• CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
• CVE-2024-22018 - fs.lstat bypasses permission model (Low)
• CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
• CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Commits

• [60e184a6e4] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
• [025cbd6936] - lib,permission: support fs.lstat (RafaelGSS) nodejs-private/node-private#486
• [d38ea17341] - lib,permission: disable fchmod/fchown when pm enabled (RafaelG…

Link: Release 2024-07-08, Version 20.15.1 'Iron' (LTS), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

• CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
• CVE-2024-22020 - Bypass network import restriction via data URL (Medium)

Commits

• [85abedf1ff] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
• [eccd63b865] - src: handle permissive extension on cmd check (RafaelGSS) nodejs-private/node-private#596

Link: Release 2024-07-08, Version 18.20.4 'Hydrogen' (LTS), @RafaelGSS · nodejs/node · GitHub