Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/node
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v20.12.0
Choose a base ref
...
head repository: nodejs/node
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v20.12.1
Choose a head ref
  • 5 commits
  • 92 files changed
  • 5 contributors

Commits on Mar 26, 2024

  1. Working on v20.12.1 

    PR-URL: #52212
    @richardlau
    richardlau committed Mar 26, 2024
    Configuration menu
    Copy the full SHA
    025ba26 View commit details
    Browse the repository at this point in the history

Commits on Apr 2, 2024

  1. src: ensure to close stream when destroying session 

    Co-Authored-By: Anna Henningsen <[email protected]>
PR-URL: nodejs-private/node-private#561
Fixes: https://hackerone.com/reports/2319584
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
CVE-ID: CVE-2024-27983
    @RafaelGSS @addaleax
    RafaelGSS and addaleax committed Apr 2, 2024
    Configuration menu
    Copy the full SHA
    ba1ae6d View commit details
    Browse the repository at this point in the history

  2. deps: update undici to v5.28.4 

    Signed-off-by: Matteo Collina <[email protected]>

PR-URL: nodejs-private/node-private#576
Reviewed-By: Rafael Gonzaga <[email protected]>
    @mcollina @RafaelGSS
    mcollina authored and RafaelGSS committed Apr 2, 2024
    Configuration menu
    Copy the full SHA
    bd8f10a View commit details
    Browse the repository at this point in the history

  3. http: do not allow OBS fold in headers by default 

    PR-URL: nodejs-private/node-private#557
Refs: nodejs-private/node-private#556
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
CVE-ID: CVE-2024-27982
    @ShogunPanda @RafaelGSS
    ShogunPanda authored and RafaelGSS committed Apr 2, 2024
    Configuration menu
    Copy the full SHA
    5e34540 View commit details
    Browse the repository at this point in the history

Commits on Apr 3, 2024

  1. 2024-04-03, Version 20.12.1 'Iron' (LTS) 

    This is a security release.

Notable changes:

* CVE-2024-27983 - Assertion failed in node::http2::Http2Session::\~Http2Session() leads to HTTP/2 server crash- (High)
* CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
* llhttp version 9.2.1
* undici version 5.28.4

PR-URL: nodejs-private/node-private#575
    @RafaelGSS
    RafaelGSS committed Apr 3, 2024
    Configuration menu
    Copy the full SHA
    957a99c View commit details
    Browse the repository at this point in the history
Loading