nodejs/node
### [`v12.22.7`](https://togithub.com/nodejs/node/releases/v12.22.7)
[Compare Source](https://togithub.com/nodejs/node/compare/v12.22.6...v12.22.7)
This is a security release.
##### Notable changes
- **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium)
- The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication.
- **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium)
- The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication.
##### Commits
- \[[`21a2e554e3`](https://togithub.com/nodejs/node/commit/21a2e554e3)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286)
- \[[`d5d3a03246`](https://togithub.com/nodejs/node/commit/d5d3a03246)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286)
- \[[`0858587f21`](https://togithub.com/nodejs/node/commit/0858587f21)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286)
Configuration
📅 Schedule: "after 10:30 before 18:00 every weekday except after 13:00 before 14:00" in timezone America/Lima.
🚦 Automerge: Enabled.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box.
This PR contains the following updates:
12.22.6->12.22.7Release Notes
nodejs/node
### [`v12.22.7`](https://togithub.com/nodejs/node/releases/v12.22.7) [Compare Source](https://togithub.com/nodejs/node/compare/v12.22.6...v12.22.7) This is a security release. ##### Notable changes - **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) - The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication. - **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium) - The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication. ##### Commits - \[[`21a2e554e3`](https://togithub.com/nodejs/node/commit/21a2e554e3)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286) - \[[`d5d3a03246`](https://togithub.com/nodejs/node/commit/d5d3a03246)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286) - \[[`0858587f21`](https://togithub.com/nodejs/node/commit/0858587f21)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#286](https://togithub.com/nodejs-private/node-private/pull/286)Configuration
📅 Schedule: "after 10:30 before 18:00 every weekday except after 13:00 before 14:00" in timezone America/Lima.
🚦 Automerge: Enabled.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.