--- title: "Security releases all round" publication: "Node Weekly" issue: 383 published_at: "2021-04-08" canonical_url: "https://nodeweekly.com/issues/383" --- Plus preventing code injections, tracking the pointer and keyboard, and some ICYMI items. | #383 — April 8, 2021 [Read on the Web](https://nodeweekly.com/issues/383) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/in2c60bj0jrn6kltlj7w.jpg)](https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/) [April 2021 Security Releases Out Now](https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/) — As mentioned last week, releases were on their way to fix a variety of high severity security issues and [15.14.0 (Latest)](https://nodejs.org/en/blog/release/v15.14.0/), [14.16.1 (LTS)](https://nodejs.org/en/blog/release/v14.16.1/), [12.22.1 (LTS)](https://nodejs.org/en/blog/release/v12.22.1/) and [10.24.1 (LTS)](https://nodejs.org/en/blog/release/v10.24.1/) are now here. More on the actual security issues below. **Security issues fixed in releases above:** - _OpenSSL: CA certificate check bypass with X509_V_FLAG_X509_STRICT_ – this relates to security checks on certificates with [more details here](https://www.openssl.org/news/secadv/20210325.txt). - _OpenSSL: NULL pointer deref in `signature_algorithms` processing_ – a TLS server can be made to crash if sent a maliciously crafted renegotiation message. - _npm upgrade: Update y18n to fix Prototype-Pollution_ – Maliciously overwriting the prototypes of objects is called [prototype pollution](https://medium.com/node-modules/what-is-prototype-pollution-and-why-is-it-such-a-big-deal-2dd8d89a93c) and this affects an issue with that in `y18n`. Affects 14.x, 12.x, and 10.x only. [![\](https://copm.s3.amazonaws.com/d780bbd4.png)](https://www.datadoghq.com/dg/apm/node-performance-metrics/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyPMetrics) [Get Visibility into Your Node Apps with End-To-End Traces](https://www.datadoghq.com/dg/apm/node-performance-metrics/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyPMetrics) — Datadog's distributed tracing and APM generates flame graphs from real requests, enabling you to visualize app performance in real-time. Pivot seamlessly to related logs and metrics without switching tools for full context. Try Datadog APM free. Datadog APM sponsor [NodeCSV 5.50: A Full Featured CSV Parser with a Simple API](https://github.com/adaltas/node-csv) — Generation, parsing, transformation and serialization of CSV, and tested on large datasets too. The [official homepage](https://csv.js.org/) has a good example of using it. Adaltas [Five Ways to Prevent Code Injection in JavaScript and Node](https://snyk.io/blog/5-ways-to-prevent-code-injection-in-javascript-and-node-js/) — Some best practices for keeping your Node projects safe from code injection attacks. Liran Tal [A Look at Class `static` Initializer Blocks in V8 9.1](https://v8.dev/features/class-static-initializer-blocks) — Sure, it looks a little _Java_-y, but this new syntax gives you a defined place to put code that runs just once for a defined class. Expect this in Chrome 91 (and therefore V8 9.1, we assume). Shu-yu Guo 💻 **Jobs** [Find Software Engineering Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=5-minutes) — Take 5 minutes to build your free profile & start getting interviews for your next job. Companies on Hired are actively hiring right now. Hired [Node.js Developer at X-Team (Remote)](https://x-team.com/remote-nodejs-developer-jobs/?utm_source=cooperpress&utm_medium=email-ad&utm_campaign=node) — Join the most energizing community for developers and work on long-term projects for Riot Games, FOX, Sony, Coinbase, and more. X-Team 📗 **Tutorials and Stories** [Sending Tuples from Node to Rust (and Back)](https://nightly.fluvio.io/blog/2021/04/node-bindgen-tuples/) — A developer needed to call a Rust API from Node and ran into some problems - here’s the story of how he solved them. Nick Mosher [Using Top-Level `await` in Node Modules](https://www.stefanjudis.com/today-i-learned/top-level-await-is-available-in-node-js-modules/) — From Node v14.8 onward, top-level `await` can be used _in ES modules_ [without needing](https://github.com/nodejs/node/pull/34558) to use the `--harmony-top-level-await` flag. Stefan Judis [Observability Won’t Replace Monitoring (Because It Shouldn’t)](https://go.lightstep.com/register-observability-replace-monitoring-co.html?utm_campaign=node&utm_source=cooper&utm_medium=Email) Lightstep sponsor [Node Development with Docker and Docker Compose](https://www.nodejsdesignpatterns.com/blog/node-js-development-with-docker-and-docker-compose/) — Using Docker and Docker Compose to develop Nod projects can be a good option, especially if working in a team. This article provides a walk-through of a possible setup and some pros and cons of the approach. Giuseppe Morelli ▶[Deploying Packages with GitHub Actions](https://channel9.msdn.com/Shows/DevOps-Lab/Deploying-packages-with-GitHub-Actions) Channel 9 [Getting Started with Apache Kafka in Node.js](https://thecodebarbarian.com/getting-started-with-apache-kafka-in-node-js.html) Valeri Karpov 🛠 Code and Tools supported by [![Okta\](https://res.cloudinary.com/cpress/image/upload/v1602154330/de7dtktheistsfpqdem4.png)](https://developer.okta.com/?utm_campaign=newsletter_cooperpress_all_multiple_inc_dev_sponsored-section_null&utm_source=cooperpress&utm_medium=cpc) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/gnea7l220nhczyb3j16n.jpg)](https://github.com/sindresorhus/active-win) [active-win: Get Metadata About the Active Window](https://github.com/sindresorhus/active-win) — I haven’t thought of a good use for this yet but it’s interesting. Running it in the terminal, say, gives you the title, width, height, x and y of the window. Sindre Sorhus [iohook: Global Keyboard and Mouse Listener](https://github.com/wilix-team/iohook) — Similarly to the item above, this does what it says and with the [sample code](https://wilix-team.github.io/iohook/usage.html) you can track the pointer and keyboard globally on your system. wilix.team [[New\] AI Security Scanning for WebStorm - Try the Free Security Plugin](https://plugins.jetbrains.com/plugin/10972-snyk-vulnerability-scanner) — Avoid the refactoring fire drill. Catch (and fix) security issues as you code. Try Snyk’s free WebStorm security plugin. Snyk sponsor [StrongSoap 3.2: A SOAP Driver for Node](https://github.com/strongloop/strong-soap) — A complete rewrite of `node-soap` and a heavier alternative to easy-soap-request which we covered in depth in [issue 378](https://nodeweekly.com/issues/378). StrongLoop [PM2 WebUI: An Open-Source Alternative to PM2 Plus](https://github.com/suryamodulus/pm2-webui) — May be useful if you’re using the [PM2](https://pm2.keymetrics.io/) process manager. Surya T [it-to-stream 1.0: Convert Streaming Iterables to Node Streams](https://github.com/alanshaw/it-to-stream) Alan Shaw [Tail: A Zero Dependency Module for Tailing a File](https://github.com/lucagrulla/node-tail) Luca Grulla [p-queue: A Promise Queue with Concurrency Control](https://github.com/sindresorhus/p-queue) — Useful for rate-limiting operations such as when interacting with third party APIs. Sindre Sorhus 🕰 **ICYMI** _(Some older stuff that's worth checking out...)_ - Zach Gollwitzer shared a free six-hour [video course teaching you how to implement user authentication from scratch](https://www.freecodecamp.org/news/learn-to-implement-user-authentication-in-node-apps-using-passport-js/) in Node and Express apps. - Darko Milosevic shows us [how to make your own online radio server](https://blog.logrocket.com/online-radio-server-pure-node-js/) using pure Node. - Kelvin Omereshone demonstrates [how to write automated tests on web APIs](https://www.smashingmagazine.com/2020/09/automate-api-testing-postman/) with Postman. - Lighthouse Parade is a [Node-based command line tool](https://github.com/cloudfour/lighthouse-parade) that crawls a domain and compiles a report with Lighthouse performance data for every page. - Motionless is [a static site generator for making sites using plain JavaScript and HTML](https://github.com/chr15m/motionless) with Node. **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)