James M Snell
This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities.
Notable changes
- http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216). HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.
- http-parser: upgrade from 1.0 to 1.1
- openssl: upgrade from 1.0.1q to 1.0.1r. To mitigate against the Logjam attack, TLS clients now reject Diffie-Hellman handshakes with parameters shorter than 1024-bits, up from the previous limit of 768-bits.
- src:
- introduce new
--security-revert={cvenum}command line flag for selective reversion of specific CVE fixes - allow the fix for CVE-2016-2216 to be selectively reverted using
--security-revert=CVE-2016-2216
- introduce new
- build:
- xz compressed tar files will be made available from nodejs.org for v0.10 builds from v0.10.42 onward
- A headers.tar.gz file will be made available from nodejs.org for v0.10 builds from v0.10.42 onward, a future change to node-gyp will be required to make use of these
Commits
- [fdc332183e] - build: enable xz compressed tarballs where possible (Rod Vagg) https://github.com/nodejs/node/pull/4894
- [2d35b421b5] - deps: upgrade openssl sources to 1.0.1r (Shigeki Ohtsu) https://github.com/joyent/node/pull/25368
- [b31c0f3ea4] - deps: update http-parser to version 1.1 (James M Snell)
- [616ec1d6b0] - doc: clarify v0.10.41 openssl tls security impact (Rod Vagg) https://github.com/nodejs/node/pull/4153
- [ccb3c2377c] - http: strictly forbid invalid characters from headers (James M Snell)
- [f0af0d1f96] - src: avoid compiler warning in node_revert.cc (James M Snell)
- [df80e856c6] - src: add --security-revert command line flag (James M Snell)
- [ff58dcdd74] - tools: backport tools/install.py for headers (Richard Lau) https://github.com/nodejs/node/pull/4149
Windows 32-bit Installer: https://nodejs.org/dist/v0.10.42/node-v0.10.42-x86.msi
Windows 64-bit Installer: https://nodejs.org/dist/v0.10.42/x64/node-v0.10.42-x64.msi
Windows 32-bit Binary: https://nodejs.org/dist/v0.10.42/node.exe
Windows 64-bit Binary: https://nodejs.org/dist/v0.10.42/x64/node.exe
Mac OS X Universal Installer: https://nodejs.org/dist/v0.10.42/node-v0.10.42.pkg
Mac OS X 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-darwin-x64.tar.gz
Mac OS X 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-darwin-x86.tar.gz
Linux 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-linux-x86.tar.gz
Linux 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-linux-x64.tar.gz
SmartOS 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-sunos-x86.tar.gz
SmartOS 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-sunos-x64.tar.gz
Source Code: https://nodejs.org/dist/v0.10.42/node-v0.10.42.tar.gz
Other release files: https://nodejs.org/dist/v0.10.42/
Documentation: https://nodejs.org/docs/v0.10.42/api/
Shasums (GPG signing hash: SHA512, file hash: SHA256):
------BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816 node.exe
aed0f1ba2e58ceec1c06050f5f0d3eaad6630da2457d2bf1bb839e68f33fd7b0 node.exp
647609c5f6d885752d4374cf5fd67de72c896b43f888c4c37db9e6bd90633c50 node.lib
5b4b8f3f88ef533ebb7e9baecdd8e9ae8e8f53559320e77ea176a607be4d6858 node.pdb
356b4891c7060b6a68cf126837689807c30d43b709120b7fe6f167404612eb5a node-v0.10.42-darwin-x64.tar.gz
cb794c57c5af5c06ef4b24bbbc423dd155867e2e01ee266f2da8e8c6aa5a33d3 node-v0.10.42-darwin-x64.tar.xz
ff61d24f80db9c5e6b007103751cdb8ac6cb3ff4180972ce1532bcb934847e0c node-v0.10.42-darwin-x86.tar.gz
7c67fc5992f5b038bebfd7274b7d4197011470562737d46b9a006876692513d1 node-v0.10.42-darwin-x86.tar.xz
64d3e067cda5a675b44cee9875d1d72f8a29ed8bc19e476a16467336b832bfb3 node-v0.10.42-headers.tar.gz
5add37eb5d1f8f9ac061524dcbe8a87a17b9af19f9521f622fdc491cbf23dc32 node-v0.10.42-headers.tar.xz
a9b80fb22efc483b6aef282ebb0254b5d9b092ed8091521977af593069a81d53 node-v0.10.42-linux-x64.tar.gz
fd049d9f6a53497092568c81c77a85c3035911ff687eeece95e98b59fb543ec6 node-v0.10.42-linux-x64.tar.xz
5e528360a59314e2357184a8582d4d9dd1aa1c77687145bcf11b23e28f4ddd00 node-v0.10.42-linux-x86.tar.gz
f19ee1f785ea79d26187c8956e01a9362bbfbcb117d98d6bd6c6927a6d33906a node-v0.10.42-linux-x86.tar.xz
600b983bf2802d29d175da885fb0b5905195b322dc0c2d45c510ef5de356fb66 node-v0.10.42.pkg
af15246d6889db4449dc46d5c4a549bb56b19481cbb801d30a09153ba71b88e1 node-v0.10.42-sunos-x64.tar.gz
5c15420d3fa7253f966cd29ea9d863d383ce05bca040c517c204a4abbc31d353 node-v0.10.42-sunos-x64.tar.xz
3333f1fd394bdde5aafa424d945b002b0d0876e17396f864af9c230c81aac08b node-v0.10.42-sunos-x86.tar.gz
ae9ceedb9f80eda4d14fb29b3b862b29acf1a45666b34d53867aad80c05ef1b6 node-v0.10.42-sunos-x86.tar.xz
ebc1d53698f80c5a7b0b948e1108d7858f93d2d9ebf4541c12688d85704de105 node-v0.10.42.tar.gz
9b4cc1b5bc397d80dfe217625b04bb6212a3b5a8b1e0eb36000a30d7ae567b8a node-v0.10.42.tar.xz
8fc72fa366d886cf41a80bcc0b78b37e3eb7a0eb78a9b80e8d328accec430150 node-v0.10.42-x86.msi
aefe011af949fa65cc89df70815f61abe3839841a069f85d4db6e9f55281bc6d openssl-cli.exe
5d6869db2027e9a7a5a912d597a5772d2630515315119affb96d4ff91cacd9ed openssl-cli.pdb
94d2835c74d6dd8c4e457a0f4c48be9fec48c15d185b6e2874794d1e9a19561f x64/node.exe
d44a2acd401c0e2c388cf58607f90b275728b4e51650bd4516dce13de436c5e0 x64/node.exp
e1526036dc9acc16072f2da806a240b8b93fbe1e67368e10b0cfb96703f579d3 x64/node.lib
8ea78b09fa6014542b4eba8b8d03243effa2099425d41d66c7368b2a008abe06 x64/node.pdb
93609d2b7c127121150a3d65f123da0038d80ab870bf9844c05130bd9d2e7c71 x64/node-v0.10.42-x64.msi
4c4b7452a192e5b1b4596fa3375baa100a88bba7f81fb95c3c7f8641b818dbb3 x64/openssl-cli.exe
14fbf4dad971c6bfe64c46bd667613f8c0756c1d425bbef740b4fc213e30ea5a x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQEcBAEBCgAGBQJWuhvlAAoJEHNBsVwHCHesU7sH/jkm32kqNQA+qV4V4nO4W2XQ
m+RHBfLKoXzw26amM17I9UNtbjzEcwfmVj060qmdjZgofer/aFx+cP43SpiVPVmG
BD4jfp46wqsd4v4R+ZBwQV/GppTU/Xsfux4k5h7ied2oIoSJsUQhhBNdUk4GZj2/
iDPhIe/3ugBFJVnT+YGGmM/y7V9L8hz91K+jxmkGx0p2EQZchkYSXYWONXv9pVbz
VNhLmW7H7/afuIqBlsA327Q4ZdGAgqVqLqiPGkwzRQOob2+Wlb7nHsger7VnMh9S
XJf42E17IDB3zVD2HHPzaSti3BC+Jm18i0PwBqE3YksTnPPxry70GGmSm7OK6iY=
=NYfo
-----END PGP SIGNATURE-----