aboutsummaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)Author
2019-09-02doc: escape elements swallowed as HTML in markdownNick Schonning
Addresses Markdownlint MD033 issues. Altering changlog should usually be avoided, but they don't render currently. PR-URL: https://github.com/nodejs/node/pull/29374 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01doc: add extends for derived classesKamat, Trivikram
PR-URL: https://github.com/nodejs/node/pull/29290 Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-31doc: add blanks around code fencesNick Schonning
Addresses Markdownlint MD031 rule warnings PR-URL: https://github.com/nodejs/node/pull/29366 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Gus Caplan <me@gus.host> Reviewed-By: David Carlier <devnexen@gmail.com>
2019-08-31doc: format http2 anchor link and referenceNick Schonning
Some links were flagged as empty links by Markdownlint MD042. The HttpServerResponse anchor link was also not defined. PR-URL: https://github.com/nodejs/node/pull/29362 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-08-31doc: remove multiple consecutive blank linesNick Schonning
These are rendered as single breaks. Addresses Markdownlint MD012 rule. PR-URL: https://github.com/nodejs/node/pull/29352 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-08-29doc,crypto: add extends for derived classesKamat, Trivikram
PR-URL: https://github.com/nodejs/node/pull/29302 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2019-08-28doc: inconsistent indentation for list itemsNick Schonning
Items at same level should have consistent indentation level. Addresses Markdownlint MD005 errors. PR-URL: https://github.com/nodejs/node/pull/29330 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-28doc: heading levels should only increment by oneNick Schonning
These are flagged by Markdownlint MD001 rule. PR-URL: https://github.com/nodejs/node/pull/29331 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-27src: allow --interpreted-frames-native-stack in NODE_OPTIONSMatheus Marchini
PR-URL: https://github.com/nodejs/node/pull/27744 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2019-08-26doc,fs: add extends for derived classesKamat, Trivikram
PR-URL: https://github.com/nodejs/node/pull/29304 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-26doc,errors: add extends to derived classesKamat, Trivikram
PR-URL: https://github.com/nodejs/node/pull/29303 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2019-08-262019-08-26, Version 12.9.1 (Current)Michaël Zasso
Notable changes: This release fixes two regressions in the http module: * Fixes an event listener leak in the HTTP client. This resulted in lots of warnings during npm/yarn installs. https://github.com/nodejs/node/pull/29245 * Fixes a regression preventing the `'end'` event from being emitted for keepalive requests in case the full body was not parsed. https://github.com/nodejs/node/pull/29263 PR-URL: https://github.com/nodejs/node/pull/29321
2019-08-23doc,http: add extends for derived classesTrivikram Kamat
Also removed redundant statments as extends is self-explanatory. PR-URL: https://github.com/nodejs/node/pull/29255 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-23doc: add https.Server extends tls.ServerTrivikram Kamat
PR-URL: https://github.com/nodejs/node/pull/29256 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
2019-08-23doc,tls: add extends for derived classesTrivikram Kamat
PR-URL: https://github.com/nodejs/node/pull/29257 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-23net: allow reading data into a static bufferBrian White
Co-Authored-By: Anna Henningsen <anna@addaleax.net> PR-URL: https://github.com/nodejs/node/pull/25436 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2019-08-23doc: fix nits in esm.mdVse Mozhet Byt
* ```mjs -> ```js as our linting of doc code fragments does not recognize this tag, IIRC. * Add semicolons to a code fragment. * Fix ASCII sorting in bottom references. PR-URL: https://github.com/nodejs/node/pull/29242 Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
2019-08-23fs: add recursive option to rmdir()cjihrig
This commit adds a recursive option to fs.rmdir(), fs.rmdirSync(), and fs.promises.rmdir(). The implementation is a port of the npm module rimraf. PR-URL: https://github.com/nodejs/node/pull/29168 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Roman Reiss <me@silverwind.io> Reviewed-By: Ben Coe <bencoe@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
2019-08-23doc: add missing extends Http2SessionTrivikram Kamat
Adds missing extends Http2Session for ClientHttp2Session and ServerHttp2Session. PR-URL: https://github.com/nodejs/node/pull/29252 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2019-08-23doc: indicate that Http2ServerRequest extends ReadableTrivikram Kamat
PR-URL: https://github.com/nodejs/node/pull/29253 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
2019-08-23doc: indicate that Http2ServerResponse extends StreamTrivikram Kamat
Also removes the redundant statement explained by "extends Stream". PR-URL: https://github.com/nodejs/node/pull/29254 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
2019-08-22doc: add emitClose option for fs streamsRich Trott
PR-URL: https://github.com/nodejs/node/pull/29212 Fixes: https://github.com/nodejs/node/issues/29177 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-08-202019-08-20, Version 12.9.0 (Current)Michaël Zasso
Notable changes: * crypto: * Added an oaepHash option to asymmetric encryption which allows users to specify a hash function when using OAEP padding. https://github.com/nodejs/node/pull/28335 * deps: * Updated V8 to 7.6.303.29. https://github.com/nodejs/node/pull/28955 * Improves the performance of various APIs such as `JSON.parse` and methods called on frozen arrays. * Adds the Promise.allSettled method. * Improves support of `BigInt` in `Intl` methods. * For more information: https://v8.dev/blog/v8-release-76 * Updated libuv to 1.31.0. https://github.com/nodejs/node/pull/29070 * `UV_FS_O_FILEMAP` has been added for faster access to memory mapped files on Windows. * `uv_fs_mkdir()` now returns `UV_EINVAL` for invalid filenames on Windows. It previously returned `UV_ENOENT`. * The `uv_fs_statfs()` API has been added. * The `uv_os_environ()` and `uv_os_free_environ()` APIs have been added. * fs: * Added `fs.writev`, `fs.writevSync` and `filehandle.writev` (promise version) methods. They allow to write an array of `ArrayBufferView`s to a file descriptor. https://github.com/nodejs/node/pull/25925 https://github.com/nodejs/node/pull/29186 * http: * Added three properties to `OutgoingMessage.prototype`: `writableObjectMode`, `writableLength` and `writableHighWaterMark` https://github.com/nodejs/node/pull/29018 * stream: * Added an new property `readableEnded` to readable streams. Its value is set to `true` when the `'end'` event is emitted. https://github.com/nodejs/node/pull/28814 * Added an new property `writableEnded` to writable streams. Its value is set to `true` after `writable.end()` has been called. https://github.com/nodejs/node/pull/28934 PR-URL: https://github.com/nodejs/node/pull/29210
2019-08-20stream: disallow stream methods on finished streamRobert Nagy
Invoke callback with ERR_STREAM_ALREADY_FINISHED error if `end()` is called on a finished stream. PR-URL: https://github.com/nodejs/node/pull/28687 Refs: https://github.com/nodejs/node/issues/28667 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-20bootstrap: run preload prior to frozen-intrinsicsBradley Farias
This is used to allow people to run polyfills. Co-Authored-By: Anna Henningsen <github@addaleax.net> PR-URL: https://github.com/nodejs/node/pull/28940 Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Gus Caplan <me@gus.host> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-20esm: support loading data URLsBradley Farias
Co-Authored-By: Jan Olaf Krems <jan.krems@gmail.com> PR-URL: https://github.com/nodejs/node/pull/28614 Reviewed-By: Jan Krems <jan.krems@gmail.com>
2019-08-19stream: add readableEndedRobert Nagy
Adds a readableEnded property and improved finished compat with possible stream-like objects. PR-URL: https://github.com/nodejs/node/pull/28814 Refs: https://github.com/nodejs/node/issues/28813 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-19fs: add writev() promises versioncjihrig
https://github.com/nodejs/node/pull/25925 added fs.writev() and fs.writevSync(), but did not include a Promises based equivalent. This commit adds the missing method. Refs: https://github.com/nodejs/node/pull/25925 PR-URL: https://github.com/nodejs/node/pull/29186 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-19doc: add missing deprecation numbercjihrig
https://github.com/nodejs/node/pull/29015 landed with the new deprecation listed as DEP0XXX. This commit assigns the new deprecation a valid ID. Refs: https://github.com/nodejs/node/pull/29015 PR-URL: https://github.com/nodejs/node/pull/29183 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-08-19src: update NODE_MODULE_VERSION to 78Michaël Zasso
Major V8 updates are usually API/ABI incompatible with previous versions. This commit adapts NODE_MODULE_VERSION for V8 7.7. Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md PR-URL: https://github.com/nodejs/node/pull/28918 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-17http2: remove callback-based paddingAnna Henningsen
This option is not useful in practice, as mentioned in comments and the documentation, because the overhead of calling into JS makes it unreasonably expensive. PR-URL: https://github.com/nodejs/node/pull/29144 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-17http: replace superfluous connection property with getter/setterRobert Nagy
PR-URL: https://github.com/nodejs/node/pull/29015 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-17http,stream: add writableEndedRobert Nagy
This is work towards resolving the response.finished confusion and future deprecation. Note that implementation-wise, streams have both an ending and ended state. However, in this case (in order to avoid confusion in user space) writableEnded is equal to writable.ending. The ending vs ended situation is internal state required for internal stream logic. PR-URL: https://github.com/nodejs/node/pull/28934 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-16fs: add fs.writev() which exposes syscall writev()Anas Aboureada
fs with writev allow many buffers to be pushed to underlying OS APIs in one batch, so this should improve write speed to files. Refs: https://github.com/nodejs/node/issues/2298 PR-URL: https://github.com/nodejs/node/pull/25925 Fixes: https://github.com/nodejs/node/issues/2298 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-17tls: allow client-side sockets to be half-openedLuigi Pinca
Make `tls.connect()` support an `allowHalfOpen` option which specifies whether or not to allow the connection to be half-opened when the `socket` option is not specified. PR-URL: https://github.com/nodejs/node/pull/27836 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ouyang Yadong <oyydoibh@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
2019-08-16readline: establish y in cursorTo as optionalGerhard Stoebich
Parameter y in cursorTo() is optional and this is also verified by tests but docs don't state this. Besides that if the newly added parameter callback is used with no y, it's quite unhandy. This PR allows to simply omit y. PR-URL: https://github.com/nodejs/node/pull/29128 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-16stream: fix destroy() behaviorRobert Nagy
Ensure errorEmitted is always set. Only emit 'error' once. PR-URL: https://github.com/nodejs/node/pull/29058 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-16doc: mention N-API as recommended approachMichael Dawson
We've had a few comments that from the doc it might not be clear that N-API is the recommended approach for Addons. As a start, mention N-API early in the non N-API section as the recommended approach unless lower level access is required. PR-URL: https://github.com/nodejs/node/pull/28922 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-16doc: fixup changelog for v10.16.3Andrew Hughes
Remove (SEMVER-MINOR) label from patch commit. Add link to table. Refs: https://github.com/nodejs/node/pull/26990 PR-URL: https://github.com/nodejs/node/pull/29159 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
2019-08-16doc: fix introduced_in note in querystring.mdBen Noordhuis
The method descriptions mentioned the right version but for some reason the top-level description did not. Well, now it does. PR-URL: https://github.com/nodejs/node/pull/29014 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
2019-08-152019-08-15, Version 8.16.1 'Carbon' (LTS)Beth Griggs
This is a security release. Notable changes: Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Vulnerabilities fixed: * CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. * CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU,or both, potentially leading to a denial of service. * CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. * CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service. * CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google) PR-URL: https://github.com/nodejs/node/pull/29152
2019-08-152019-08-15, Version 10.16.3 'Dubnium' (LTS)Beth Griggs
This is a security release. Notable changes: Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Vulnerabilities fixed: * CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. * CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU,or both, potentially leading to a denial of service. * CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. * CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service. * CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google) PR-URL: https://github.com/nodejs/node/pull/29148
2019-08-152019-08-15, Version 12.8.1 (Current)Michaël Zasso
This is a security release. Notable changes: Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Vulnerabilities fixed: * CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. * CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU,or both, potentially leading to a denial of service. * CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. * CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service. * CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google) PR-URL: https://github.com/nodejs/node/pull/29133
2019-08-14doc: note that stream error can close streamRobert Nagy
PR-URL: https://github.com/nodejs/node/pull/29082 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-12doc, lib, src, test, tools: fix assorted typosXhmikosR
PR-URL: https://github.com/nodejs/node/pull/29075 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2019-08-12doc: clarify async iterator leakRobert Nagy
Clarifies that creating multiple async iterators from the same stream can lead to event listener leak. PR-URL: https://github.com/nodejs/node/pull/28997 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-08-12module: pkg exports validations and fallbacksGuy Bedford
PR-URL: https://github.com/nodejs/node/pull/28949 Reviewed-By: Bradley Farias <bradley.meck@gmail.com> Reviewed-By: Jan Krems <jan.krems@gmail.com>
2019-08-09doc: fix nits in child_process.mdVse Mozhet Byt
* Use `console.error()` for error or stderr output. * Unify comment style. * Unify link format. * Correct link URL. * Fix some typos. PR-URL: https://github.com/nodejs/node/pull/29024 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-09doc: improve UV_THREADPOOL_SIZE descriptionTobias Nießen
PR-URL: https://github.com/nodejs/node/pull/29033 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2019-08-07module: refine package name validationGuy Bedford
PR-URL: https://github.com/nodejs/node/pull/28965 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Jan Krems <jan.krems@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-14 06:51:11 +0000