Node.js v11.3.0 (Current)

Rod Vagg

This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735)

Notable Changes

deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735
http:
- Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
- A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

[8f191f3759] - deps: update openssl 1.1.0 upgrade docs (Sam Roberts) #24523
[f20ac47d7a] - deps: update archs files for OpenSSL-1.1.0 (Sam Roberts) #24523
[8248d227b7] - deps: add s390 asm rules for OpenSSL-1.1.0 (Shigeki Ohtsu) #24523
[65d03f0180] - deps: upgrade openssl sources to 1.1.0j (Sam Roberts) #24523
[a2b8aba23c] - deps,http: llhttp set max header size to 8KB (Rod Vagg) nodejs-private/node-private#149
[74e01d0020] - deps,http: http_parser set max header size to 8KB (Matteo Collina) nodejs-private/node-private#143
[4ecbd3bdaa] - http: reset headers_nread_ on llhttp parser reuse (Rod Vagg) nodejs-private/node-private#149
[04e0620597] - http: fix header limit errors and test for llhttp (Fedor Indutny) nodejs-private/node-private#149
[315ee2e626] - (SEMVER-MINOR) http,https: protect against slow headers attack (Matteo Collina) nodejs-private/node-private#144
[d7504324e1] - url: avoid hostname spoofing w/ javascript protocol (Matteo Collina) nodejs-private/node-private#145

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

37cd261b32d2c6e320d99d9ea5e3d57dc4efd0f279e2366563c2a1c58ea7bf5c  node-v11.3.0-aix-ppc64.tar.gz
54acc7bdeffae79fdd73f959712305aee1d8d487d56813b43cae96d151ec79db  node-v11.3.0-darwin-x64.tar.gz
8b5d9ea204126d01ae77804144f8f1719086b15abf24628a673b14665866f9dc  node-v11.3.0-darwin-x64.tar.xz
ec21aa45c8790e3ab8df531f760458222237a3b8fe61aeef0532d7a11d0aa2bd  node-v11.3.0-headers.tar.gz
7c5a8c50952288f2e059e77b5aa5dcb32d1f52f0bbc07683a77827de6d239589  node-v11.3.0-headers.tar.xz
e6e90080b95f780102980059ac3b2b2f7f6465f13ffa78d946f4c4df9ce97ff1  node-v11.3.0-linux-arm64.tar.gz
642cc3fc94a856ad6d09e76eaf869672bef925308afdad398a58f18eeaf4e4b8  node-v11.3.0-linux-arm64.tar.xz
9ba1cbaa7441173715eef1e81142fc131c609b9218f6168d152e2bae9f0e2875  node-v11.3.0-linux-armv6l.tar.gz
bc0e3cc5adb6360ba23910391b6a5f19b44bf750b24108b7ddd9f62ca2675fe6  node-v11.3.0-linux-armv6l.tar.xz
790a609e3355272ee243f9c9eee5530bf101cf7d2ba1f644de043362fea61dfb  node-v11.3.0-linux-armv7l.tar.gz
d6bce33d832363650bbf4c80367180ebaa8f71c4904acd608fa3e31127275591  node-v11.3.0-linux-armv7l.tar.xz
34b045a84d4731c9464d8c0d37f0fe894ca56e0003bc8cfdaabf69130ec4e490  node-v11.3.0-linux-ppc64le.tar.gz
d0499d85edf3293aa4c965ce0d32eb52249b2bba05142d46583d4d14440b6a06  node-v11.3.0-linux-ppc64le.tar.xz
02c2e8dbbd8ffe8b3b80c51a51545441cf005ac8540a74be787f91e7a02c778d  node-v11.3.0-linux-s390x.tar.gz
bc623c56da1fe9eea8b65571e6d451c70639f592da9191cd9263fca639e6443b  node-v11.3.0-linux-s390x.tar.xz
aac519aac1814e8590cd6b55fb2c6ddc1bbb825fc8c097abce5f5361aea61108  node-v11.3.0-linux-x64.tar.gz
d37fb7fae8a185409bccf106e91d8ffa3450115852795512fc62e6da0b5e3dbb  node-v11.3.0-linux-x64.tar.xz
d9de46dc842b10e0e73e9a8f9b78a891f224763fa943e593937c45666e1f9d78  node-v11.3.0.pkg
467bc51c794a27ef77a1c81128478c7558fcb8cd67edc59f42b6e29d902b29d9  node-v11.3.0-sunos-x64.tar.gz
3f4d37156edb83b70648819499c9184a72fbcb546129a243089ea5ece48c04c4  node-v11.3.0-sunos-x64.tar.xz
9db85052ec091a2a0ff6b928bed5030b6383846e8d677726648d042268169407  node-v11.3.0.tar.gz
08c4a159242af4c68752260d59ed209fc86b073ee669443fa591eecacb6093da  node-v11.3.0.tar.xz
a6a931e8c8f6dfd21f86da1ca14666a21069c4d033e39e734e787e4c50499bc6  node-v11.3.0-win-x64.7z
b801e908ec36a07f06df388845e22e0b7f3cede7a4030896712c8ee28cdb3f05  node-v11.3.0-win-x64.zip
8369634a081e77b5e21344a8dd57add942c760a8d1193175d0ee88b91b8e1902  node-v11.3.0-win-x86.7z
d3f4dbe65060bbec5ce02ea87880c81ec51494dad78b0cdd2bdd2efb29a91654  node-v11.3.0-win-x86.zip
2438bf1a549edfde2a1760692760b7b937533fa7a47b6554d2c28ee999ce03e5  node-v11.3.0-x64.msi
6550cf2519d3c76341900eb0cb0213d59933b7c6fcbcc84ca58691a80c4797c5  node-v11.3.0-x86.msi
cf75c2d68e73ec0b8ed43c437719a890956e3aaafda5b3f3e930a6c868e36098  win-x64/node.exe
9eab50d1f65165a3c9d685c5a05b0a957a46105f0d2179cb40b007e14464bc96  win-x64/node.lib
d49e907a1ca91f9483b8c6430c3323d9da7d30423c92242d29588334d08a4e06  win-x64/node_pdb.7z
1dc81c11fcea581de11f591f32e1b8a0fbd28b8dcf9140ab026cc744d277c568  win-x64/node_pdb.zip
50d631b43f94b7eca57fd5a8615aa74d4127a6188135a3ccc68365973dd33c20  win-x86/node.exe
d434239ba4597aaa820fd31126240bf1b327cf871a6b6108d891147b3112f728  win-x86/node.lib
b2d29aa640da3c70b5b57923d91fa27734776c45d771a9b5a3cb29e28995367a  win-x86/node_pdb.7z
65f5189ad28c9f59c77c4e1ff87763c6fcc0b3d5c39ba4969b1eeb4589b73b84  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE3Y8jOLrnUB491ax4wnN5L32DVF0FAlv95CwACgkQwnN5L32D
VF1Kpwf/TSV8EvpfiR6rYJ3GGdmmfmJregELYXz+Lt90C49jDbitI/8MSWMysGUa
P5qEdRcnSvW0wYNFbaVDFgtuMR7S3VwSKZ39ByKIaCP0e6ihb1IHuGC+0Iiy4vjx
or7cAT+lVe4Y06Vs0BwHlWUFI80V2zzBj2chkiWs6ZSbkxcs0AqCqlpxw+MtAYIz
GekqYj95BDStLJcP2n8Kow31Alkb9QF9NwL8J/8bPtPlBvmP/GRy//Bv5Y3+4GHy
iRJhiyVc8jReu+SpqDhPcS6VhBF9yv4flAGTGAmoM4Ky5xZ2B5AJzKtgYu2Ht94J
i16RRK7XOEeO1+iMLfGheyZ1gI1Jvw==
=62lQ
-----END PGP SIGNATURE-----

Node.js v10.14.1 (LTS)Node.js v10.14.0 (LTS)