v24.4.1

nodejs/nodev24.4.1Jul 15, 2025by RafaelGSS

AI Summary

A security release addressing vulnerabilities in V8 and Windows path handling.

Key Highlights

CVE-2025-27209: HashDoS vulnerability in V8 with RapidHash algorithm
CVE-2025-27210: Bypass of path traversal protection for Windows reserved device names (CON, PRN, AUX)

Full Release Notes




This is a security release.

### Notable Changes

* (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
* (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

### Commits

* \[[`c33223f1a5`](https://github.com/nodejs/node/commit/c33223f1a5)] - **(CVE-2025-27209)** **deps**: V8: revert rapidhash commits (Michaël Zasso) [nodejs-private/node-private#713](https://github.com/nodejs-private/node-private/pull/713)
* \[[`56f9db2aaa`](https://github.com/nodejs/node/commit/56f9db2aaa)] - **(CVE-2025-27210)** **lib**: handle all windows reserved driver name (RafaelGSS) [nodejs-private/node-private#721](https://github.com/nodejs-private/node-private/pull/721)