Have a Node JS Server? Update it Now!

NodeJS Jan 2021 released its security update and its time to go through them!

Resources
use-after-free in TLSWrap (High) (CVE-2020-8265)
HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)
OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

🎙️Listen to the Backend Engineering Podcast

🏭 Backend Engineering Videos

💾 Database Engineering Videos

🏰 Load Balancing and Proxies Videos

🏛️ Software Archtiecture Videos

📩 Messaging Systems

Become a Member

Support me on PayPal

Join our Thriving Backend Community on Discord

Stay Awesome,
Hussein

[willbrickner]

Nice video. Don't throw Rust's name in the mix there, use after free is impossible to write in rust due to lifetime analysis.

[AkshayPuli]

Read the title and logged into docker to start updating Nodejs! As I watch the video ;) Thanks again Hussein, love your videos!

[mamtachahal]

Everything becomes so easy when you explain it. Love your videos a lot sir. <3

[eunlimlee]

I never thought reading security releases would be fun. Thanks a lot!

[moralizer]

I am not even using node but seeing the title almost made me update

[hmod]

Great explanation of the vulnerabilities, worth the sub.

[EnTransic]

Always great content. Thank you for your work and sharing what you have learned.

[autohmae]

6:22 I guess really everything is a DNS issue. ;-)

[ngneerin]

I think just recreating docker image and running container from it will solve the problem. Let me know if I am wrong

[reviewer]

ha ha ha... This video thumbnail is wonderful.

[snugglepuff]

Really making the case for moving off of memory-unsafe languages here.

[rajdeeppurkayastha]

Sir do you use node.js mostly at your work?

[justanothergunguy]

Reverse proxying Node with NGINX literally mitigates all of these. This is why we reverse proxy our applications.

[constantineJohn]

Interesting what's is the best runtime for backend ???

[danilaplee]

you should not terminate tls on nodejs

[amandwivedi]

Man! What to say when a secure protocol like ssl and tls is not secure.

[debugmedia]

Great video asusual. Do you cover about the bitcoin, blockchain technology? How it works, If its the future. What are your thoughts?

[cg]

I don't know jack about computers but I love your videos hahaha

[Stoney_Eagle]

If anyone wants to try on me, I'm curious to see what happens. Hit me a DM

[KangJangkrik]

Nevermind, I'll use Deno instead