nodejs-february-2024-security-releases: Wednesday February 14 2024 Security Releases
Updates are now available for the v18.x, v20.x and v21.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
libuv 1.48.0 v21.x (CVE-2024-24806).
libuv on v18.x and v20.x has been patched to address CVE-2024-24806.
undici 5.28.3 on all release lines (CVE-2024-24758, GHSA-3787-6prv-h9w3).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libuvto a version that resolves this vulnerability.Fixed in 1.48.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 5.28.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Node.js release lines received fixes in this release?
Updates are available for the Node.js v18.x, v20.x, and v21.x release lines. CVE-2024-24806 is addressed through libuv updates or patches on those lines, while undici 5.28.3 is included on all release lines.
Which vulnerabilities are addressed by the dependency updates?
The release addresses CVE-2024-24806 in libuv and CVE-2024-24758 plus GHSA-3787-6prv-h9w3 in undici. The provided information does not specify affected configurations, exploitation prerequisites, or mitigations other than applying the available updates.