About Node.js 12
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Notable Changes
This is planned to be the final Node.js 12 release. Node.js 12 will
reach End-of-Life status on 30 April 2022, after which it will no
receive updates. You are strongly advised to migrate your applications
to Node.js 16 or 14 (both of which are Long Term Support (LTS) releases)
to continue to receive future security updates beyond 30 April 2022.
This release fixes a shutdown crash in Node-API (formerly N-API) and a
potential stack overflow when using vm.runInNewContext().
The list of GPG keys used to sign releases and instructions on how to
fetch the keys for verifying binaries has been synchronized with the
main branch.
Commits
- [1193290f3f] - deps: V8: cherry-pick cc9a8a37445e (devsnek) #42065
- [333eda8d03] - doc: add a note about possible missing lines to readline.asyncIterator (Igor Mikhalev) #34675
- [518a49c0c6] - doc: use openpgp.org for keyserver examples (Nick Schonning) #39227
- [11aef2ad03] - doc: update release key for Danielle Adams (Danielle Adams) #36793
- [a9c38f1003] - doc: add release key for Danielle Adams (Danielle Adams) #35545
- [a35f553889] - doc: add release key for Bryan English (Bryan English) #42102
- [5f104e3218] - node-api: cctest on v8impl::Reference (legendecas) #38970
- [e23c04f0dc] - node-api: avoid SecondPassCallback crash (Michael Dawson) #38899
- [a7224c9559] - node-api: fix shutdown crashes (Michael Dawson) #38492
- [81b4dc88f1] - node-api: make reference weak parameter an indirect link to references (Chengzhong Wu) #38000
- [2aa9ca1ea9] - node-api: fix crash in finalization (Michael Dawson) #37876
- [a2f4206415] - node-api: stop ref gc during environment teardown (Gabriel Schulhof) #37616
- [171bb66ccc] - node-api: force env shutdown deferring behavior (Gabriel Schulhof) #37303
- [e707514c80] - src: fix finalization crash (James M Snell) #38250
| Publisher | Node.js Foundation |
|---|---|
| Author | OpenJS Foundation |
| Version | 12.22.12 |
| Release date | 2022-04-05 |
| License | MIT |
| Installer type | wix, zip |
| Architecture | x86, x64 |
| Package ID | OpenJS.NodeJS.12 |
| Admin rights | Required |
| Install scope | All users |
winget install --id=OpenJS.NodeJS.12 -ewinget upgrade --id=OpenJS.NodeJS.12 -ewinget uninstall --id=OpenJS.NodeJS.12 -emsiexec /i "node-v12.22.12-x64.msi" /quiet /norestartmsiexec /x {0F6E1F50-886C-4D6D-A9F3-C82282CEF46A} /quietNode.js 12 adds these commands to the command line: corepack, node, npm, npx.
Node.js 12 can open or be associated with 3 file types:
This is a security release.
Notable changes
Update to OpenSSL 1.1.1n, which addresses the following vulnerability:
- Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778)
More details are available at https://www.openssl.org/news/secadv/20220315.txt
Fix for building Node.js 12.x with Visual Studio 2019 to allow us to continue to
run CI tests.
Commits
- [e3e5bf11ba] - build: pin Windows GitHub runner to windows-2019 (Richard Lau) #42349
- [f41e7771bf] - build: fix detection of Visual Studio 2019 (Richard Lau) #42349
- [c372ec207d] - deps: update archs files for OpenSSL-1.1.n (Richard Lau) #42348
- [d574a1dccb] - deps: upgrade openssl sources to 1.1.1n (Richard Lau) #42348
Notable changes
- Upgrade npm to 6.14.16
- Updated ICU time zone data
Commits
- [33899b435d] - deps: upgrade npm to 6.14.16 (Ruy Adorno) #41601
- [d9237c46ca] - tools: update tzdata to 2021a4 (Albert Wang) #41443
This is a security release.
Notable changes
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44531 after publication.
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44532 after publication. …
Yes. Node.js 12 is free and open-source software released under the MIT license.
The latest version is 12.22.12, released on Apr 5, 2022.
The download button links to the official installer published on nodejs.org, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with 76102997f9084e1faa544693ad1daeef68394d46ae7e363ad8df1fa86896133f.
Node.js 12 runs on Windows and is available for 32-bit (x86), 64-bit (x64) systems.
Run the offline installer with msiexec /i "node-v12.22.12-x64.msi" /quiet /norestart, or install it with Windows Package Manager: winget install --id=OpenJS.NodeJS.12 -e --silent.
Open Settings › Apps › Installed apps, find Node.js 12 and select Uninstall. From the command line, run winget uninstall --id=OpenJS.NodeJS.12 -e.
Node.js 12 supports 3 file types, including .cjs, .js, .mjs.