diff --git a/CHANGELOG.md b/CHANGELOG.md index a5eb8df10951..adac1878c311 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,7 +26,8 @@ release. -6.15.0
+6.15.1
+6.15.0
6.14.4
6.14.3
6.14.2
diff --git a/doc/changelogs/CHANGELOG_V6.md b/doc/changelogs/CHANGELOG_V6.md index 9e5ff731f27b..aeaaff1d072c 100644 --- a/doc/changelogs/CHANGELOG_V6.md +++ b/doc/changelogs/CHANGELOG_V6.md @@ -7,6 +7,7 @@ +6.15.1
6.15.0
6.14.4
6.14.3
@@ -66,6 +67,17 @@ [Node.js Long Term Support Plan](https://github.com/nodejs/LTS) and will be supported actively until April 2018 and maintained until April 2019. + +## 2018-12-03, Version 6.15.1 'Boron' (LTS), @rvagg + +### Notable Changes + +This is a patch release to address a bad backport of the fix for "Slowloris HTTP Denial of Service" (CVE-2018-12122). Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session, resulting in prematurely disconnected sockets. + +### Commits + +* [[`5d9005c359`](https://github.com/nodejs/node/commit/5d9005c359)] - **http**: fix backport of Slowloris headers (Matteo Collina) [#24796](https://github.com/nodejs/node/pull/24796) + ## 2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg diff --git a/lib/_http_server.js b/lib/_http_server.js index 54e080717a75..a224cc795fc1 100644 --- a/lib/_http_server.js +++ b/lib/_http_server.js @@ -481,6 +481,9 @@ function connectionListener(socket) { function parserOnIncoming(req, shouldKeepAlive) { incoming.push(req); + // Set to zero to communicate that we have finished parsing. + socket.parser.parsingHeadersStart = 0; + // If the writable end isn't consuming, then stop reading // so that we don't become overwhelmed by a flood of // pipelined requests that may never be resolved. diff --git a/src/node_version.h b/src/node_version.h index 3bab0fbabdf1..a8e3701bc388 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -3,7 +3,7 @@ #define NODE_MAJOR_VERSION 6 #define NODE_MINOR_VERSION 15 -#define NODE_PATCH_VERSION 0 +#define NODE_PATCH_VERSION 1 #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "\x42\x6f\x72\x6f\x6e"