Node v4.1.1 (Current)

This release contains some minor security-related updates. You are advised to upgrade to 4.1.1 if you are currently running v4.1.0.

Notable changes

buffer : Fixed a bug introduced in v4.1.0 where allocating a new zero-length buffer can result in the next allocation of a TypedArray in JavaScript not being zero-filled. In certain circumstances this could result in data leakage via reuse of memory space in TypedArrays, breaking the normally safe assumption that TypedArrays should be always zero-filled. (Trevor Norris) #2931.

: Fixed a bug introduced in v4.1.0 where allocating a new zero-length buffer can result in the next allocation of a TypedArray in JavaScript not being zero-filled. In certain circumstances this could result in data leakage via reuse of memory space in TypedArrays, breaking the normally safe assumption that TypedArrays should be always zero-filled. (Trevor Norris) #2931. http : Guard against response-splitting of HTTP trailing headers added via response.addTrailers() by removing new-line ( [\r

] ) characters from values. Note that standard header values are already stripped of new-line characters. The expected security impact is low because trailing headers are rarely used. (Ben Noordhuis) #2945.

: Guard against response-splitting of HTTP trailing headers added via by removing new-line ( ) characters from values. Note that standard header values are already stripped of new-line characters. The expected security impact is low because trailing headers are rarely used. (Ben Noordhuis) #2945. npm : Upgrade to npm 2.14.4 from 2.14.3, see release notes for full details (Kat Marchán) #2958 Upgrades graceful-fs on multiple dependencies to no longer rely on monkey-patching fs Fix npm link for pre-release / RC builds of Node

: Upgrade to npm 2.14.4 from 2.14.3, see release notes for full details (Kat Marchán) #2958 v8 : Update post-mortem metadata to allow post-mortem debugging tools to find and inspect: JavaScript objects that use dictionary properties (Julien Gilli) #2959 ScopeInfo and thus closures (Julien Gilli) #2974

: Update post-mortem metadata to allow post-mortem debugging tools to find and inspect:

Known issues

See https://github.com/nodejs/node/labels/confirmed-bug for complete and current list of known issues.

Some problems with unreferenced timers running during beforeExit are still to be resolved. See #1264.

are still to be resolved. See #1264. Surrogate pair in REPL can freeze terminal. #690

Calling dns.setServers() while a DNS query is in progress can cause the process to crash on a failed assertion. #894

while a DNS query is in progress can cause the process to crash on a failed assertion. #894 url.resolve may transfer the auth portion of the url when resolving between two full hosts, see #1435.

Commits

[ d63e02e08d ] - buffer : don't set zero fill for zero-length buffer (Trevor Norris) #2931

] - : don't set zero fill for zero-length buffer (Trevor Norris) #2931 [ 5905b14bff ] - build : fix icutrim when building small-icu on BE (Stewart Addison) #2602

] - : fix icutrim when building small-icu on BE (Stewart Addison) #2602 [ f010cb5d96 ] - configure : detect mipsel host (Jérémy Lal) #2971

] - : detect mipsel host (Jérémy Lal) #2971 [ b93ad5abbd ] - deps : backport 357e6b9 from V8's upstream (Julien Gilli) #2974

] - : backport 357e6b9 from V8's upstream (Julien Gilli) #2974 [ 8da3da4d41 ] - deps : backport ff7d70b from V8's upstream (Julien Gilli) #2959

] - : backport ff7d70b from V8's upstream (Julien Gilli) #2959 [ 2600fb8ae6 ] - deps : upgraded to [email protected] in npm (Kat Marchán) #2958

] - : upgraded to in npm (Kat Marchán) #2958 [ 793aad2d7a ] - deps : upgrade to npm 2.14.4 (Kat Marchán) #2958

] - : upgrade to npm 2.14.4 (Kat Marchán) #2958 [ 43e2b7f836 ] - doc : remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921

] - : remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921 [ 9c59d2f16a ] - doc : remove extra using v8::HandleScope statement (Christopher J. Brody) #2983

] - : remove extra using v8::HandleScope statement (Christopher J. Brody) #2983 [ f7edbab367 ] - doc : clarify description of assert.ifError() (Rich Trott) #2941

] - : clarify description of assert.ifError() (Rich Trott) #2941 [ b2ddf0f9a2 ] - doc : refine process.kill() and exit explanations (Rich Trott) #2918

] - : refine process.kill() and exit explanations (Rich Trott) #2918 [ f68fed2e6f ] - http : remove redundant code in _deferToConnect (Malcolm Ahoy) #2769

] - : remove redundant code in _deferToConnect (Malcolm Ahoy) #2769 [ f542e74c93 ] - http : guard against response splitting in trailers (Ben Noordhuis) #2945

] - : guard against response splitting in trailers (Ben Noordhuis) #2945 [ bc9f629387 ] - http_parser : do not dealloc during kOnExecute (Fedor Indutny) #2956

] - : do not dealloc during kOnExecute (Fedor Indutny) #2956 [ 1860e0cebd ] - lib,src : remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921

] - : remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921 [ d4cd5ac407 ] - readline : fix tab completion bug (Matt Harrison) #2816

] - : fix tab completion bug (Matt Harrison) #2816 [ 9760e04839 ] - repl : don't use tty control codes when $TERM is set to "dumb" (Salman Aljammaz) #2712

] - : don't use tty control codes when $TERM is set to "dumb" (Salman Aljammaz) #2712 [ cb971cc97d ] - repl : backslash bug fix (Sakthipriyan Vairamani) #2968

] - : backslash bug fix (Sakthipriyan Vairamani) #2968 [ 2034f68668 ] - src : honor --abort_on_uncaught_exception flag (Evan Lucas) #2776

] - : honor --abort_on_uncaught_exception flag (Evan Lucas) #2776 [ 0b1ca4a9ef ] - src : Add ABORT macro (Evan Lucas) #2776

] - : Add ABORT macro (Evan Lucas) #2776 [ 4519dd00f9 ] - test : test sync version of mkdir & rmdir (Sakthipriyan Vairamani) #2588

] - : test sync version of mkdir & rmdir (Sakthipriyan Vairamani) #2588 [ 816f609c8b ] - test : use tmpDir instead of fixtures in readdir (Sakthipriyan Vairamani) #2587

] - : use tmpDir instead of fixtures in readdir (Sakthipriyan Vairamani) #2587 [ 2084f52585 ] - test : test more http response splitting scenarios (Ben Noordhuis) #2945

] - : test more http response splitting scenarios (Ben Noordhuis) #2945 [ fa08d1d8a1 ] - test : add test-spawn-cmd-named-pipe (Alexis Campailla) #2770

] - : add test-spawn-cmd-named-pipe (Alexis Campailla) #2770 [ 71b5d80682 ] - test : make cluster tests more time tolerant (Michael Dawson) #2891

] - : make cluster tests more time tolerant (Michael Dawson) #2891 [ 3e09dcfc32 ] - test : update cwd-enoent tests for AIX (Imran Iqbal) #2909

] - : update cwd-enoent tests for AIX (Imran Iqbal) #2909 [ 6ea8ec1c59 ] - tools: single, cross-platform tick processor (Matt Loring) #2868

Windows 32-bit Installer: https://nodejs.org/dist/v4.1.1/node-v4.1.1-x86.msi

Windows 64-bit Installer: https://nodejs.org/dist/v4.1.1/node-v4.1.1-x64.msi

Windows 32-bit Binary: https://nodejs.org/dist/v4.1.1/win-x86/node.exe

Windows 64-bit Binary: https://nodejs.org/dist/v4.1.1/win-x64/node.exe

Mac OS X 64-bit Installer: https://nodejs.org/dist/v4.1.1/node-v4.1.1.pkg

Mac OS X 64-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-darwin-x64.tar.gz

Linux 32-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-linux-x86.tar.gz

Linux 64-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-linux-x64.tar.gz

SmartOS 32-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-sunos-x86.tar.gz

SmartOS 64-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-sunos-x64.tar.gz

ARMv6 32-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-linux-armv6l.tar.gz

ARMv7 32-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-linux-armv7l.tar.gz

ARMv8 64-bit Binary: https://nodejs.org/dist/v4.1.1/node-v4.1.1-linux-arm64.tar.gz

Source Code: https://nodejs.org/dist/v4.1.1/node-v4.1.1.tar.gz

Other release files: https://nodejs.org/dist/v4.1.1/

Documentation: https://nodejs.org/docs/v4.1.1/api/

Shasums (GPG signing hash: SHA512, file hash: SHA256):