Node.js 16 16.20.2

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 28th March.
- OpenSSL security advisory 20th April.
- OpenSSL security advisory 30th May
- c-ares vulnerabilities:
- GHSA-9g78-jv2r-p7vc
- GHSA-8r8p-23f3-64c2
- GHSA-54xr-f67r-4pc4
- GHSA-x6mf-cxr9-8q6v
More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.
Commits
- [5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
- [5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
- [c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
- [155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #48369
- [8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #48369
- [1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426 …

Notable Changes
- deps:
- update undici to 5.20.0 (Node.js GitHub Bot) #46711
- update c-ares to 1.19.0 (Michaël Zasso) #46415
- upgrade npm to 8.19.4 (npm team) #46677
- update corepack to 0.17.0 (Node.js GitHub Bot) #46842
- (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376
Commits
- [de6dd67790] - crypto: avoid hang when no algorithm available (Richard Lau) #46237
- [4617512788] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #46185
- [24972164fc] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711
- [85f88c6a8d] - deps: V8: cherry-pick 90be99fab31c (Michaël Zasso) #46646
- [b4ebe6d47b] - deps: update c-ares to 1.19.0 (Michaël Zasso) #46415
- [56cbc7fdda] - deps: V8: cherry-pick c2792e58035f (Jiawen Geng) #44961
- [7af9bdb31e] - deps: upgrade npm to 8.19.4 (npm team) #46677
- [962a7471b5] - deps: update corepack to 0.17.0 (Node.js GitHub Bot) #46842
- [748bc96e35] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #46710
- [a467782499] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #46037
- [1913b6763d] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #45635
- [809371a15f] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #45147
- [086bb2f8d4] - Revert "src: let http2 streams end after session close" (Rich Trott) #46721
- [6a01d39120] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376 …

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
- CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
- CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
Fixed by an update to undici:
- CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
- See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
- CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
- See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
- [7fef050447] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
- [b558e9f476] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
- [160adb7ffc] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
- [d0ece30948] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377 …