From 31d3b6d9cbf6f533e7990fa1b7f82976bc384c64 Mon Sep 17 00:00:00 2001 From: Beth Griggs Date: Tue, 4 Feb 2020 21:17:22 +0000 Subject: 2020-02-06, Version 12.15.0 'Erbium' (LTS) This is a security release. Vulnerabilities fixed: * **CVE-2019-15606**: HTTP header values do not have trailing OWS trimmed. * **CVE-2019-15605**: HTTP request smuggling using malformed Transfer-Encoding header. * **CVE-2019-15604**: Remotely trigger an assertion on a TLS server with a malformed certificate string. Also, HTTP parsing is more strict to be more secure. Since this may cause problems in interoperability with some non-conformant HTTP implementations, it is possible to disable the strict checks with the `--insecure-http-parser` command line flag, or the `insecureHTTPParser` http option. Using the insecure HTTP parser should be avoided. PR-URL: https://github.com/nodejs-private/node-private/pull/197 --- CHANGELOG.md | 3 ++- doc/api/cli.md | 2 +- doc/api/http.md | 4 ++-- doc/changelogs/CHANGELOG_V12.md | 32 ++++++++++++++++++++++++++++++++ src/node_version.h | 6 +++--- 5 files changed, 40 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ec16a2f3d8c..f02bdaae234 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,7 +28,8 @@ release. -12.14.1
+12.15.0
+12.14.1
12.14.0
12.13.1
12.13.0
diff --git a/doc/api/cli.md b/doc/api/cli.md index b70845cffc2..eb53aed510e 100644 --- a/doc/api/cli.md +++ b/doc/api/cli.md @@ -422,7 +422,7 @@ Specify the `module` of a custom [experimental ECMAScript Module][] loader. ### `--insecure-http-parser` Use an insecure HTTP parser that accepts invalid HTTP headers. This may allow diff --git a/doc/api/http.md b/doc/api/http.md index d81c3a574bd..a02b1d6a08f 100644 --- a/doc/api/http.md +++ b/doc/api/http.md @@ -1917,7 +1917,7 @@ Found'`.