Node.js v18/v20 Security Release: Path Traversal, HTTP/2 Rapid Reset & More

From this webpage screenshot, the following key information about the vulnerabilities can be obtained: 1. Date and Version: - Release Date: October 13, 2023 - Versions: v18.x and v20.x 2. Vulnerability List: - undici: Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143) - nghttp2: HTTP/2 Rapid Reset (High) - (CVE-2023-44487) - Permission model improperly protects against path traversal (High) - (CVE-2023-39331) - Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332) - Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552) - Code injection via WebAssembly export names (Low) - (CVE-2023-39333) 3. Impact: - undici: Affects all users of undici. - nghttp2: Affects all servers using HTTP/2. - Permission model: Affects all users of the experimental permission model. - Path traversal: Affects all users of the experimental permission model. 一 Integrity checks: Affects all users of the experimental policy mechanism. - Code injection: Affects all users who use the command-line option. 4. Fixes: - Node.js v20.8.1 (current version) - Node.js v18.18.2 (LTS version) 5. Summary: - 2 high-severity issues - 1 medium-severity issue - 1 low-severity issue - Updates for undici and nghttp2 6. Contact and Future Updates: - Security Policy: https://nodejs.org/security/ - Security Vulnerability Reporting: https://github.com/nodejs/node/security/policy - Security Advisory Mailing List: https://groups.google.com/forum/#!forum/nodejs-sec This information provides key details about the Node.js security update released on October 13, 2023, including the types of vulnerabilities, affected scope, fixes applied, and how to report new security issues.

Goal Reached Thanks to every supporter — we hit 100%!

Node.js v18/v20 Security Release: Path Traversal, HTTP/2 Rapid Reset & More