diff options
Diffstat (limited to 'doc/changelogs/CHANGELOG_V14.md')
| -rw-r--r-- | doc/changelogs/CHANGELOG_V14.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/doc/changelogs/CHANGELOG_V14.md b/doc/changelogs/CHANGELOG_V14.md index 3e7afb09d16..95596eb9d48 100644 --- a/doc/changelogs/CHANGELOG_V14.md +++ b/doc/changelogs/CHANGELOG_V14.md @@ -11,6 +11,7 @@ </tr> <tr> <td valign="top"> +<a href="#14.18.1">14.18.1</a><br/> <a href="#14.18.0">14.18.0</a><br/> <a href="#14.17.6">14.17.6</a><br/> <a href="#14.17.5">14.17.5</a><br/> @@ -66,6 +67,24 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) +<a id="14.18.1"></a> +## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams + +This is a security release. + +### Notable changes + +* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) + * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication. +* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium) + * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication. + +### Commits + +* [[`8c254ca7e4`](https://github.com/nodejs/node/commit/8c254ca7e4)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`9b92ae2499`](https://github.com/nodejs/node/commit/9b92ae2499)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`f467539719`](https://github.com/nodejs/node/commit/f467539719)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) + <a id="14.18.0"></a> ## 2021-09-28, Version 14.18.0 'Fermium' (LTS), @targos |