v20.18.2

nodejs/nodev20.18.2Jan 21, 2025by RafaelGSS

AI Summary

This is a security release addressing multiple vulnerabilities including path traversal on Windows, HTTP2 memory leaks, and insufficient randomness in undici fetch. It also fixes an internal worker usage issue under the permission model.

Key Highlights

Fixes CVE-2025-23083: Throws error on InternalWorker use when permission model is enabled.
Fixes CVE-2025-23085: Resolves HTTP2 memory leak on premature close and ERR_PROTO.
Fixes CVE-2025-23084: Fixes path traversal vulnerability in normalize() on Windows.
Fixes CVE-2025-22150: Updates undici to v6.21.1 to address insufficient randomness in fetch().

Full Release Notes




This is a security release.

### Notable Changes

* CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
* CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR\_PROTO (Medium)
* CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

* CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

### Commits

* \[[`df8b9f2c3e`](https://github.com/nodejs/node/commit/df8b9f2c3e)] - **(CVE-2025-22150)** **deps**: update undici to v6.21.1 (Matteo Collina) [nodejs-private/node-private#663](https://github.com/nodejs-private/node-private/pull/663)
* \[[`42d5821873`](https://github.com/nodejs/node/commit/42d5821873)] - **(CVE-2025-23084)** **path**: fix path traversal in normalize() on Windows (Tobias Nießen) [nodejs-private/node-private#555](https://github.com/nodejs-private/node-private/pull/555)
* \[[`8187a4b9bb`](https://github.com/nodejs/node/commit/8187a4b9bb)] - **src**: fix HTTP2 mem leak on premature close and ERR\_PROTO (RafaelGSS)
* \[[`389f239a28`](https://github.com/nodejs/node/commit/389f239a28)] - **(CVE-2025-23083)** **src,loader,permission**: throw on InternalWorker use (RafaelGSS) [nodejs-private/node-private#652](https://github.com/nodejs-private/node-private/pull/652)