Starstruk Logo MarkStarstruk

v23.6.1

nodejs/nodev23.6.1Jan 21, 2025by RafaelGSS

AI Summary

A security release addressing CVEs related to InternalWorker usage, HTTP2 memory leaks, path traversal, and dependency vulnerabilities in undici.

Key Highlights

  • CVE-2025-23083: High severity - Throw on InternalWorker use with permission model
  • CVE-2025-23085: Medium severity - Fix HTTP2 memory leak
  • CVE-2025-23084: Medium severity - Fix path traversal in normalize() on Windows
  • CVE-2025-22150: Medium severity - Update undici for insufficient randomness

New Features

  • Security fix for InternalWorker permission model
  • Security fix for HTTP2 memory leak
  • Security fix for path traversal
  • Security fix for undici randomness

Full Release Notes




This is a security release.

### Notable Changes

* CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
* CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR\_PROTO (Medium)
* CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

* CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

### Commits

* \[[`f2ad4d3af8`](https://github.com/nodejs/node/commit/f2ad4d3af8)] - **(CVE-2025-22150)** **deps**: update undici to v6.21.1 (Matteo Collina) [nodejs-private/node-private#654](https://github.com/nodejs-private/node-private/pull/654)
* \[[`0afc6f9600`](https://github.com/nodejs/node/commit/0afc6f9600)] - **(CVE-2025-23084)** **path**: fix path traversal in normalize() on Windows (RafaelGSS) [nodejs-private/node-private#555](https://github.com/nodejs-private/node-private/pull/555)
* \[[`3c7686163e`](https://github.com/nodejs/node/commit/3c7686163e)] - **(CVE-2025-23085)** **src**: fix HTTP2 mem leak on premature close and ERR\_PROTO (RafaelGSS) [nodejs-private/node-private#650](https://github.com/nodejs-private/node-private/pull/650)
* \[[`51938f023a`](https://github.com/nodejs/node/commit/51938f023a)] - **(CVE-2025-23083)** **src,loader,permission**: throw on InternalWorker use (RafaelGSS) [nodejs-private/node-private#629](https://github.com/nodejs-private/node-private/pull/629)