2021-01-04, Version 15.5.1 (Current)

This is a security release.

Notable changes:

Vulnerabilities fixed:

- **CVE-2020-8265**: use-after-free in TLSWrap (High)
  * Affected Node.js versions are vulnerable to a use-after-free bug in
  its TLS implementation. When writing to a TLS enabled socket,
  node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly
  allocated WriteWrap object as first argument. If the DoWrite method
  does not return an error, this object is passed back to the caller as
  part of a StreamWriteResult structure. This may be exploited to
  corrupt memory leading to a Denial of Service or potentially other
  exploits.

- **CVE-2020-8287**: HTTP Request Smuggling in nodejs (Low)
  * Affected versions of Node.js allow two copies of a header field in
  a http request. For example, two Transfer-Encoding header fields. In
  this case Node.js identifies the first header field and ignores the
  second. This can lead to HTTP Request Smuggling
  (https://cwe.mitre.org/data/definitions/444.html).

PR-URL: https://github.com/nodejs-private/node-private/pull/241

1 files changed, 2 insertions, 1 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce7cabe4345..5b336b3a5ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,7 +32,8 @@ release.
 </tr>
 <tr>
     <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V15.md#15.5.0">15.5.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V15.md#15.5.1">15.5.1</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V15.md#15.5.0">15.5.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V15.md#15.4.0">15.4.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V15.md#15.3.0">15.3.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V15.md#15.2.1">15.2.1</a><br/>