Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 3 commits
- 5 files changed
- 3 contributors
Commits on Oct 12, 2022
Commits on Nov 1, 2022
-
inspector: harden IP address validation again
Use inet_pton() to parse IP addresses, which restricts IP addresses to a small number of well-defined formats. In particular, octal and hexadecimal number formats are not allowed, and neither are leading zeros. Also explicitly reject 0.0.0.0/8 and ::/128 as non-routable. Refs: https://hackerone.com/reports/1710652 CVE-ID: CVE-2022-43548 PR-URL: nodejs-private/node-private#354 Reviewed-by: Michael Dawson <midawson@redhat.com> Reviewed-by: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-by: Rich Trott <rtrott@gmail.com>
Commits on Nov 4, 2022
-
2022-11-04, Version 16.18.1 'Gallium' (LTS)
This is a security release. Notable changes: The following CVEs are fixed in this release: - CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) PR-URL: nodejs-private/node-private#363
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v16.18.0...v16.18.1