About Node.js 10
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
This is a security release.
Notable Changes
Vulerabilties fixed:
- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)
- This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
- Impacts:
- All versions of the 14.x, 12.x and 10.x releases lines
Commits
- [5e526b96ce] - deps: upgrade npm to 6.14.12 (Ruy Adorno) #37918
- [781cb6df5c] - deps: update archs files for OpenSSL-1.1.1k (Tobias Nießen) #37940
- [5db0a05a90] - deps: upgrade openssl sources to 1.1.1k (Tobias Nießen) #37940
| Publisher | Node.js Foundation |
|---|---|
| Author | OpenJS Foundation |
| Version | 10.24.1 |
| Release date | 2021-04-06 |
| License | MIT |
| Installer type | wix, zip |
| Architecture | x86, x64 |
| Package ID | OpenJS.NodeJS.10 |
| Admin rights | Required |
| Install scope | All users |
winget install --id=OpenJS.NodeJS.10 -ewinget upgrade --id=OpenJS.NodeJS.10 -ewinget uninstall --id=OpenJS.NodeJS.10 -emsiexec /i "node-v10.24.1-x64.msi" /quiet /norestartmsiexec /x {8E8991C7-B2DA-4F89-A0AC-B705B7551141} /quietNode.js 10 adds these commands to the command line: corepack, node, npm, npx.
Node.js 10 can open or be associated with 3 file types:
This is a security release.
Notable changes
Vulnerabilities fixed:
- CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
- Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
- CVE-2021-22884: DNS rebinding in --inspect
- Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
- CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt
Commits …
Notable changes
The update to npm 6.14.11 has been relanded so that npm correctly reports its version.
Commits
- [953a85035d] - crypto: fix crash when calling digest after piping (Tobias Nießen) #28251
- [fe2c98003e] - deps: upgrade npm to 6.14.11 (Ruy Adorno) #37173
- [7b7fb43b8a] - Revert "deps: upgrade npm to 6.14.11" (Richard Lau) #37278
- [1c6fbd6ffe] - test: add test that verifies crypto stream pipeline (Evan Lucas) #37009
Notable changes
Release keys have been synchronized with the main branch.
- deps:
- upgrade npm to 6.14.11 (Darcy Clarke) #36838
Commits
- [cc6b69557a] - deps: upgrade npm to 6.14.11 (Darcy Clarke) #36838
- [aefb66528a] - doc: update contact information for @BethGriggs (Beth Griggs) #35451
- [08931481d8] - doc: update contact information for richardlau (Richard Lau) #35450
- [bc0617f4ea] - doc: update release key for Danielle Adams (Danielle Adams) #36793
- [d7c09fcfd3] - doc: add release key for Danielle Adams (Danielle Adams) #35545
- [ac49d415b0] - doc: add release key for Ruy Adorno (Ruy Adorno) #34628
- [b8426ae3ce] - doc: add release key for Richard Lau (Richard Lau) #34397
Yes. Node.js 10 is free and open-source software released under the MIT license.
The latest version is 10.24.1, released on Apr 6, 2021.
The download button links to the official installer published on nodejs.org, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with dab263436eeda26c9c4809ba4d93e607dcffb3735b9a1866c77afb242a832dbd.
Node.js 10 runs on Windows and is available for 32-bit (x86), 64-bit (x64) systems.
Run the offline installer with msiexec /i "node-v10.24.1-x64.msi" /quiet /norestart, or install it with Windows Package Manager: winget install --id=OpenJS.NodeJS.10 -e --silent.
Open Settings › Apps › Installed apps, find Node.js 10 and select Uninstall. From the command line, run winget uninstall --id=OpenJS.NodeJS.10 -e.
Node.js 10 supports 3 file types, including .cjs, .js, .mjs.