--- title: "Important Node security releases for 10.x, 12.x, and 14.x" publication: "Node Weekly" issue: 356 published_at: "2020-09-17" canonical_url: "https://nodeweekly.com/issues/356" --- This week's Node news, links, and releases. #356 — September 17, 2020 [Read on the Web](https://nodeweekly.com/issues/356) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/v1600346294/xddjebo730b7s97xkfod.jpg)](https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/) [Node.js September 2020 Security Releases](https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/) — New versions of all supported release lines are out to fix three security issues, so pick up [Node 10.22.1](https://nodejs.org/en/blog/release/v10.22.1/), [12.18.4](https://nodejs.org/en/blog/release/v12.18.4/) or [14.11.0](https://nodejs.org/en/blog/release/v14.11.0/) today. Prior Node 12 and 14 releases are suspectible to an HTTP request smuggling vulnerability caused by carriage return to hyphen conversion in request headers. Prior Node 14 releases are suspectible to a DoS through unfinished HTTP/1.1 requests. And all prior releases are susceptible to buffer overflows through certain situations with `fs.realpath.native`. Michael Dawson [![\](https://copm.s3.amazonaws.com/d3df3afa.png)](https://dashboard.redisgreen.net/nodeweekly) [Redis 6.0 on RedisGreen](https://dashboard.redisgreen.net/nodeweekly) — SSL encryption, key size tracking, memory mapping, online upgrades, and more. RedisGreen sponsor [Playwright 1.4: Fast and Reliable Cross-Browser Testing](https://github.com/microsoft/playwright/releases/tag/v1.4.0) — Despite being 1.4, this is a pretty big release for the [Puppeteer](https://github.com/puppeteer/puppeteer) alternative. It now includes a CLI `playwright-cli` with which you can record user interactions and generate Playwright scripts, generate page screenshots, and more. Plus there’s experimental support for recording videos of what your scripts do with the browser. Microsoft [Telegraf: A Modern Telegram Bot Framework for Node](https://telegraf.js.org/#/) — I’ve not used _this_ library yet, but [Telegram](https://telegram.org/) is a pretty good messaging system to write bots or automated clients for as it has a solid API, and this project seems incredibly thorough. Vitaly Domnikov et al. [How I Built a Serverless Recipe App with FaunaDB and Vue.js](https://ttntm.me/blog/serverless-recipes-app-faunadb-vuejs/) — If you tend to turn to Express.js and a more traditional database for building CRUD apps, this post will present an interesting alternative approach to you. And if you ever get hooked on serverless approaches, [we have a newsletter for that!](https://serverless.email/) 😁 Tom Doe 💻 **Jobs** [Node.js Developer at X-Team (Remote)](https://x-team.com/remote-nodejs-developer-jobs/?utm_source=cooperpress&utm_medium=email-ad&utm_campaign=node) — Join the most energizing community for developers and work on projects for Riot Games, FOX, Sony, Coinbase, and more. X-Team [Find Your Next Job Through Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-nodeweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-88879) — Create a profile on Vettery to connect with hiring managers at startups and Fortune 500 companies. It's free for job-seekers. Vettery 🧑‍💻 Interested in running a job listing in this newsletter? _There's [more info here](https://booking.cooperpress.com/jobs)_. 📗 **Tutorials and Stories** ▶[What I Didn’t Do and Why: A Node Story with Dan Shaw](https://www.youtube.com/watch?v=0Kjp7d-P-kk) — Dan Shaw is a well known name in the Node world as a founder of the Node.js Foundation, The Node Firm, and then NodeSource – plus co-host of NodeUp. In this hour long talk he covers his long history with Node and how the community and ecosystem have grown. Dan Shaw [Performance Best Practices When Using Express in Production](https://expressjs.com/en/advanced/best-practice-performance.html) — Split into sections about what to do in your _code_ and what to do on the _ops_ side of things. Express.js [When the Bits Hit the Fan: AppSignal](https://appsignal.com/nodejs?utm_source=node-weekly-sponsored&utm_medium=email&utm_campaign=nodejs-landing&utm_content=sponsored-link) — AppSignal provides insights into errors, performance, servers and more - all in one clear and easy interface. AppSignal sponsor [Running a Serverless OAuth Proxy with Grant](https://dev.to/simov/serverless-oauth-proxy-1h84) — [Grant](https://github.com/simov/grant) is a JavaScript-powered OAuth proxy that, till now, has needed to be run in a typical HTTP servery way, but.. it now supports AWS Lambda, Azure Functions, Cloud Functions and Vercel out of the box. Simon Vlachkov [Working with OAuth in Node.js CLI Apps](http://thecodebarbarian.com/oauth-in-nodejs-cli-apps.html) — This is useful because it’s not the most obvious of things to do. Valeri Karpov [How to Debug a Node App Deployed with Jenkins X using Rookout](https://www.rookout.com/blog/how-to-debug-a-node-js-application-deployed-with-jenkins-x) — Note that this refers to _Jenkins X_, a Jenkins variant focused on CD on Kubernetes. Josh Hendrick 🛠 **Tools, Resources and Libraries** [npm v7.0.0 Beta 11 Released](https://blog.npmjs.org/post/629438943993200641/release-v700-beta11) — Beta 10 was meant to be the last beta before RC but a few things came up.. 😄 Isaac Z. Schlueter [chrome-aws-lambda: A Chromium Binary for AWS Lambda](https://github.com/alixaxel/chrome-aws-lambda) — A project to make it easy to use a headless Chrome instance from your AWS Lambda serverless functions. Sees frequent updates. Alix Axel [Access Your C/C++ Code From Node.js. We'll Create Your Custom Binding](https://inspiredware.com) INSPIREDWARE sponsor [Gemini 4: A 'Currently Playing' Viewer for Spotify](https://github.com/Gabe-H/Gemini) — A basic Electron app that offers an ‘easy on the eyes’ way to see what’s currently playing in Spotify. Gabe Haarberg [The Braintree Node.js Library 3.0](https://github.com/braintree/braintree_node) — If you use Braintree’s payment services, this is the first major update to their Node client library in a long while. Braintree Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc). [Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom