Why Node.js waited for OpenSSL security update before patching
As promised, the Node.js Foundation updated all maintenance, long-term-support, and stable releases of Node.js to address two critical vulnerabilities.
The patches were announced a week ago and were expected earlier this week, but the Foundation held back the release in order to include the latest OpenSSL version, also patched this week. Node.js 0.10.x (Maintenance) and 0.12.x (LTS) depend on OpenSSL 1.0.1, and Node.js 4.x (LTS Argon) and 5.x depend on OpenSSL 1.0.2.
The latest Node.js versions, 0.10.41 (Maintenance), 0.12.9 (LTS), 4.2.3 Argon (LTS), and 5.1.1 (Stable), address fixes for denial-of-service and out-of-bound access vulnerabilities and are also compiled with the latest OpenSSL libraries, Rod Vagg, the technical steering committee director at Node.js Foundation, wrote in a blog post.
