Node v0.12.10 (LTS)

By James M Snell, Feb 09, 2016

This is an important security release. For full details see https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities.

Notable changes:

http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216). HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.
http-parser: upgrade from 2.3.0 to 2.3.1
openssl: upgrade from 1.0.1q to 1.0.1r. To mitigate against the Logjam attack, TLS clients now reject Diffie-Hellman handshakes with parameters shorter than 1024-bits, up from the previous limit of 768-bits.
src:
- introduce new --security-revert={cvenum} command line flag for selective reversion of specific CVE fixes
- allow the fix for CVE-2016-2216 to be selectively reverted using --security-revert=CVE-2016-2216
build:
- xz compressed tar files will be made available from nodejs.org for v0.12 builds from v0.12.10 onward
- A headers.tar.gz file will be made available from nodejs.org for v0.12 builds from v0.12.10 onward, a future change to node-gyp will be required to make use of these

Commits:

[4312848bff] - build: enable xz compressed tarballs where possible (Rod Vagg) https://github.com/nodejs/node/pull/4894
[247626245c] - deps: upgrade openssl sources to 1.0.1r (Shigeki Ohtsu) https://github.com/joyent/node/pull/25368
[744c9749fc] - deps: update http-parser to version 2.3.1 (James M Snell)
[d1c56ec7d1] - doc: clarify v0.12.9 notable items (Rod Vagg) https://github.com/nodejs/node/pull/4154
[e128d9a5b4] - http: strictly forbid invalid characters from headers (James M Snell)
[bdb9f2cf89] - src: avoiding compiler warnings in node_revert.cc (James M Snell)
[23bced1fb3] - src: add --security-revert command line flag (James M Snell)
[f41a3c73e7] - tools: backport tools/install.py for headers (Richard Lau) https://github.com/nodejs/node/pull/4149

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

8a9c7fe990c1028e7c6d5bf61413027904a0fff67e23ba7c7c6d5fbb16cd4884  node.exe
c2b369b4fdb12c3ac14a6214c48c901e4805366a361c6cae5bb24215bf282318  node.exp
6919172dc22ad2690836a3988bf138cfc80ba484490a05a6eafda0a4909936d1  node.lib
5809753f1a8b6e3e311c41a066f0eb8f90b5b569896b6f1945af0971de9b2e4d  node.pdb
c95df35ca1ed7b4b0ded815c1d49f36defcb1fdb882f6a8ef6106a07e3f2ffef  node-v0.12.10-darwin-x64.tar.gz
b4ae523d81ced4935e0c7184bafcc1eb199d08ccfc70267a0dab546c33c18831  node-v0.12.10-darwin-x64.tar.xz
d4abd2b778c9d803676ad6121e6fdbc625b9ea73e845b0ecd761c162e86150ca  node-v0.12.10-darwin-x86.tar.gz
0bc827d4c494274855b01ff2fab4ad311fe3c0b50cc0b62bb7736c7c890d2f15  node-v0.12.10-darwin-x86.tar.xz
c8e99589d96f9ad598c2d602e3dcac4bb0147a709da4da89a1f2b7f667f4b415  node-v0.12.10-headers.tar.gz
8c44114a3f5747475a042fd2f2333d4671223638a0dfa3cb264bf32f9a7c91c5  node-v0.12.10-headers.tar.xz
8fb4d6ed8934f0b0c92c26878511e1d340b068ee966c131ba0fccc1199f4349d  node-v0.12.10-linux-x64.tar.gz
a993b72902eb1bdd50f1615026b6372a0d28302c15841b04e11bedab379709c0  node-v0.12.10-linux-x64.tar.xz
6f3ea401d2f488afb6adc57a3056df8658c1c9a57a368637cbc215ed3133c3b7  node-v0.12.10-linux-x86.tar.gz
99d0c121cd58b2d44080f78692dfb400e5098190f453709707594debd1359154  node-v0.12.10-linux-x86.tar.xz
afa45162c741898c7fc382093f29e68503edfa48cd67541d9c2c4081197fba02  node-v0.12.10.pkg
d67f17540c711eb150b8a389af1b4e6ecdcab66a1648b7ce925af98ab52b2698  node-v0.12.10-sunos-x64.tar.gz
2840f181594a0bd8b9cade785e9b6502591da68dc5a3ed3f2773637eb7df980b  node-v0.12.10-sunos-x64.tar.xz
beca24cc3615c5b1858817d121bd91eecdc3af5b98ed0c4c171e1ef60afac049  node-v0.12.10-sunos-x86.tar.gz
3cb4a9cbfd0f724c3ba6e4ca2c6c70bb6d7c103dea682acf9c8ca1125133e1a2  node-v0.12.10-sunos-x86.tar.xz
edbd3710512ec7518a3de4cabf9bfee6d12f278eef2e4b53422c7b063f6b976d  node-v0.12.10.tar.gz
f6318e5413982d40358a1b479458ebdd4bb523ae572c1149ce0e73cb58661978  node-v0.12.10.tar.xz
b888d17dbf04e43f521dbff8a68b24fae37027f6cd6b5a80430bc64fc5e7da40  node-v0.12.10-x86.msi
6153b53d72ea6cfbd6fd4a591787831c32fdd610d851fa2312eece6ac4686929  openssl-cli.exe
668479f90904e088ead0258de2941e597ba08aa61a1eed3ed96622c4c6d3bb25  openssl-cli.pdb
79687fe8d08a439f5167ab474a1238b6423cdb4f72cbc94213cfd6c21cf729f0  x64/node.exe
90116c88db51255a9c20158fd7b577769241b576d5642e269c465342c20f7025  x64/node.exp
490482c06c1ae913e3f78006aa9d41d67659e5499a4155cef2ff2ab49caf8921  x64/node.lib
58d9088252d3d5cc12647448491b6e287f9cd6a573be7b59f98ceb13fed15e2e  x64/node.pdb
a3b49281f8f07eddf310c621feb55f98bd07f7ad252d5afa215212cf3f6e12d2  x64/node-v0.12.10-x64.msi
3cf691f703fc23c71263f8f02fd8780891a0e0f6cae37b4e15353446a47014b7  x64/openssl-cli.exe
ab634d22bd0a6bbf8a1adbd144f621e600deabf957d08effed729f88db3763ab  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQEcBAEBCgAGBQJWuhv7AAoJEHNBsVwHCHes2HwH/i14nZes3/aej0uw3Yu2vhU6
X+MSyaZ4/Nrd+5YWy2BYXyVwO/PK7g508nGUqf5I4zEfmw8nwBYqyuf6891YeTR/
rD5yKhldt/lnWFLu6L8g4FKSPo3Zf0Vb1EB/xgL04VHlP6Pjh0/AOU5VS6Rvk9is
TerO4AHbYFYMkI7/xeSSPGxwhGEP5grBxOogJNRyHTfbav04VEg+kLwH59CSaYvM
PdHEvb03fOhJBDsuK1I0yADvLqtiVeUoarWO9h4HVbt2+8haPaDFpHfGREEOwyxn
hTZJUpoHMDTADd8Fzxpqbu2IPBhZwc01QUyCju8FUSTxAScCxNM1bYpuqDr934M=
=w69g
-----END PGP SIGNATURE-----