2021-10-12, Version 12.22.7 'Erbium' (LTS)
This is a security release. Notable changes: * CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details are available at: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959 * CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium) * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details are available at: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960 PR-URL: https://github.com/nodejs-private/node-private/pull/295
parent
7beff4de
Please register or sign in to comment