Notable Changes
This is a security release.
Vulnerabilities fixed:
- CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical).
- CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).
Commits
- [
dd828376a0] - deps: update llhttp to 2.1.2 (Fedor Indutny) nodejs-private/node-private#215 - [
753f3b247a] - http: add requestTimeout (Matteo Collina, Paolo Insogna, Robert Nagy) nodejs-private/node-private#208