# libuv Published articles for libuv. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How libuv CVE-2024-24806 can evade scanners and expose internal services DevFeed: [How libuv CVE-2024-24806 can evade scanners and expose internal services]() Original publisher: [Read original article]() Published: 2024-02-16T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [software dark matter](), [Security](), [Vulnerabilities](), [Containers](), [Kubernetes]() Tags: [container](), [cve](), [cve-2024-24806](), [false-negative](), [kubernetes](), [libuv](), [sbom](), [security](), [security-research](), [software-dark-matter](), [vulnerabilities]() ### AI overview The article examines CVE-2024-24806, a libuv vulnerability caused by hostname truncation without a terminating null byte when the hostname exceeds 256 characters. It explains how the flaw can enable SSRF and unauthorized access to internal APIs, including in multi-pod Kubernetes environments, and why vendored or bundled components may evade scanners and SBOM tools. ### Source excerpt Uncover Chainguard's approach to detecting and neutralizing hidden threats like CVE-2024-24806 in container environments. ## Node.js 20.4.0 (Current) DevFeed: [Node.js 20.4.0 (Current)]() Original publisher: [Read original article]() Published: 2023-07-05T14:13:56Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [V8](), [cross-platform](), [Open Source]() Tags: [benchmark](), [cross-platform](), [developers](), [javascript](), [libuv](), [linux](), [node](), [node-js](), [npm](), [open-source](), [openssl](), [performance](), [release](), [tls](), [update]() ### AI overview Node.js 20.4.0 introduces a timer-mocking API for more reliable tests of time-dependent functionality. The release also adds explicit resource management support and includes updates to TLS, cryptography, dependencies, V8, npm, and performance on Linux. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 20.3.0 (Current) DevFeed: [Node.js 20.3.0 (Current)]() Original publisher: [Read original article]() Published: 2023-06-08T16:06:19Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source]() Tags: [cross-platform](), [javascript](), [libuv](), [node-js](), [npm](), [open-source]() ### AI overview Node.js 20.3.0 is a Current release with dependency upgrades, documentation changes, semantic-minor library and Node-API updates, module and stream changes, build improvements, and fixes across crypto, clustering, snapshots, and related components. It upgrades libuv to 1.45.0 and npm to 9.6.7. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 17.5.0 (Current) DevFeed: [Node.js 17.5.0 (Current)]() Original publisher: [Read original article]() Published: 2022-02-10T18:31:29Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source](), [Command-line interface](), [Server]() Tags: [async](), [benchmark](), [command-line](), [cross-platform](), [eslint](), [fetch](), [javascript](), [js](), [libuv](), [node-js](), [npm](), [open-source](), [python](), [servers](), [v8]() ### AI overview Node.js 17.5.0 is a Current release that adds experimental support for the fetch API behind a flag, along with several stream iterator helpers and other minor changes. The release also updates npm to 8.4.1 and includes build, crypto, benchmark, and dependency maintenance. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 17.4.0 (Current) DevFeed: [Node.js 17.4.0 (Current)]() Original publisher: [Read original article]() Published: 2022-01-18T15:07:53Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source](), [servers](), [Command-line interface](), [V8](), [Git]() Tags: [benchmark](), [command-line](), [cross-platform](), [git](), [javascript](), [libuv](), [node-js](), [npm](), [open-source](), [python](), [servers](), [ubuntu](), [workflow](), [wsl]() ### AI overview Node.js 17.4.0 is a current release with semver-minor additions and fixes across child_process, crypto, events, loaders, streams, async_hooks, build tooling, and dependencies. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 12.22.8 (LTS) DevFeed: [Node.js 12.22.8 (LTS)]() Original publisher: [Read original article]() Published: 2021-12-16T23:42:46Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [Open Source](), [certificates](), [cross-platform](), [openssl](), [libuv]() Tags: [certificates](), [cross-platform](), [js](), [libuv](), [mozilla](), [node-js](), [open-source](), [openssl](), [release]() ### AI overview Node.js 12.22.8 is an LTS release that updates c-ares to fix a regression resolving CNAME records containing underscores and updates root certificates from Mozilla's Network Security Services 3.71. It also includes dependency, platform, documentation, runtime, test, and worker-process fixes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 15.9.0 (Current) DevFeed: [Node.js 15.9.0 (Current)]() Original publisher: [Read original article]() Published: 2021-02-18T02:30:19Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source]() Tags: [c-plus-plus](), [cross-platform](), [javascript](), [libuv](), [node-js](), [npm](), [open-source](), [release](), [v8]() ### AI overview Node.js 15.9.0 (Current) adds cryptographic key export in JWK format, introduces createHistogram and an asynchronous setInterval iterator, improves stream error handling, and adds X509Certificate objects for certificate access. It also includes updates to libuv, npm, V8, and documentation. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Fixing DNS in Node.js DevFeed: [Fixing DNS in Node.js]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-02-17T16:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [Node.js](), [libuv](), [Caching](), [IO](), [HTTP](), [Monitoring]() Tags: [caching](), [dns](), [http](), [io](), [javascript](), [libuv](), [monitoring](), [node](), [node-js](), [performance]() ### AI overview This article explains how DNS works in Node.js and describes implementation pitfalls that can affect application performance and reliability. It covers synchronous DNS calls within libuv's threadpool, the lack of Node.js DNS caching, the cost of repeated lookups, and failures or delays caused by DNS server problems. ### Source excerpt DNS is one of those invisible technologies that you use every day, but which works so well that you can conveniently ignore it. That is until it breaks completely, or slows your application down to a crawl, or you want to resolve something unusual, and then you're in a world of trouble. Unfortunately, DNS in Node.js isn't implemented quite as you might have hoped, and includes some gotchas that can create some of these problems for you, when you least expect it. If you're a node developer, it's worth understanding how it works in detail, so you can understand what your code is really doing, and boost your application performance & reliability. Why is Node.js DNS problematic? DNS is how you turn domain names (example.com) into IP addresses (93.184.216.34). That sounds easy, but there's a whole world of complexity in here. Critically, this is something that most modern applications do a lot, every time you make an HTTP request or any other network request to a machine, on the internet and often within your internal infrastructure too. In node specifically this can go wrong in quite a few ways, because: DNS requests in node appear asynchronous, but they're actually internally implemented as synchronous calls within node's internal libuv threadpool (which by default has only 4 threads). That means if you do >4 DNS lookups in parallel then you're going to block the libuv threadpool, even though they look like async IO. This will block every other DNS lookup, and also unrelated file IO and various crypto APIs, creating some extremely confusing performance problems. Node itself doesn't do any DNS caching at all. All of that is delegated to the OS, out of your control, and every DNS lookup must go to the OS every time. DNS lookups aren't free. If you're frequently making requests to a wide variety of different hostnames or hostnames with a short TTL (e.g. if you support webhooks, if you're building a monitoring tool, or if you're polling URLs elsewhere) then you may quickly ## Node.js 12.18.1 (LTS) DevFeed: [Node.js 12.18.1 (LTS)]() Original publisher: [Read original article]() Published: 2020-06-17T16:28:46Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [npm](), [Open Source](), [V8]() Tags: [cross-platform](), [javascript](), [libuv](), [lts](), [node-js](), [npm](), [open-source](), [v8]() ### AI overview Node.js 12.18.1 is an LTS release that updates dependencies, including V8, uvwasi, libuv, and npm. It also includes asynchronous hooks, buffer performance, ECMAScript module, filesystem, documentation, and Windows error-handling changes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 13.14.0 (Current) DevFeed: [Node.js 13.14.0 (Current)]() Original publisher: [Read original article]() Published: 2020-04-30T13:54:45Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [V8](), [cross-platform](), [Open Source](), [Command-line interface]() Tags: [cli](), [cross-platform](), [documentation](), [javascript](), [libuv](), [node-js](), [open-source](), [openssl](), [release](), [report](), [testing](), [visual-studio]() ### AI overview Node.js 13.14.0 is a Current release containing updates to async_hooks, vm compilation, buffer handling, build configuration, the CLI report feature, OpenSSL, V8, libuv, and documentation. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 10.20.0 (LTS) DevFeed: [Node.js 10.20.0 (LTS)]() Original publisher: [Read original article]() Published: 2020-04-08T16:11:48Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [releases](), [JavaScript](), [TLS (Transport Layer Security)](), [npm](), [macOS](), [Xcode](), [Open Source](), [cross-platform]() Tags: [cross-platform](), [developers](), [javascript](), [libuv](), [lts](), [macos](), [node](), [node-js](), [npm](), [open-source](), [openssl](), [release](), [tls](), [update](), [xcode]() ### AI overview Node.js 10.20.0 is an LTS release with macOS package notarization support, buffer BigInt64 methods, dependency updates including npm, OpenSSL, libuv, and V8 changes, plus build and documentation fixes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.