diff --git a/source/changelog.md b/source/changelog.md index b79752e..08ff03d 100644 --- a/source/changelog.md +++ b/source/changelog.md @@ -4,6 +4,18 @@ excerpt: Learn more about changes introduced in various SVR.JS versions. date: 2023-12-21 17:10:14 --- +## SVR.JS 3.14.16 LTS + +* Prevented DoS attacks performed with forward proxy HTTP requests with malformed URLs. + +## SVR.JS 3.15.0 + +* Changed URL parser from wrapper over WHATWG URL parser to custom regex-based URL parser. +* Optimized server code. +* Redesigned default error pages. +* Removed blocking file system calls from the directory listing function. +* Replaced _path.extname()_ function with regex-based function. + ## SVR.JS 3.14.15 * Fixed crashes related to the request ID generation. diff --git a/source/docs.md b/source/docs.md index d0ac232..a61eea5 100644 --- a/source/docs.md +++ b/source/docs.md @@ -1612,7 +1612,7 @@ Extension of resource defined in the request. Parsed _Url_ object created by _url.parse()_ method (includes parsed query string). -SVR.JS 3.3.1 and newer include hostname of the server (it uses wrapper over WHATWG URL API), older versions don't. +SVR.JS 3.3.1 and newer include hostname of the server (3.3.1 to 3.14.x use wrapper over WHATWG URL API; 3.15.0 and newer use custom URL parser), older versions don't. #### _search_ diff --git a/source/index.md b/source/index.md index 44177a2..c51be28 100644 --- a/source/index.md +++ b/source/index.md @@ -3,7 +3,7 @@ title: Main page date: 2024-01-21 19:41:01 layout: index-page sitemap: false -svrjsversion: 3.14.15 +svrjsversion: 3.15.0 ---
@@ -13,11 +13,11 @@ svrjsversion: 3.14.15

Host a webpage, run server-side JavaScript, use mods to expand server functionality, or use it as a forward or reverse proxy — all in SVR.JS! SVR.JS is a web server that runs on top of Node.JS, thus enabling server-side JavaScript on webpages. SVR.JS also has an integrated log viewer, log highlighter, and user management tool. SVR.JS can run not only on Node.JS but also in Bun (experimental support).

- Download SVR.JS 3.14.15 + Download SVR.JS 3.15.0

- No supported LTS version + Download SVR.JS 3.14.16 LTS
diff --git a/source/vulnerabilities.md b/source/vulnerabilities.md index 581d139..eb8e171 100644 --- a/source/vulnerabilities.md +++ b/source/vulnerabilities.md @@ -9,6 +9,10 @@ If you find a security issue with SVR.JS, report it as soon as possible to _vuln ## SVR.JS +### Fixed in SVR.JS 3.15.0 and in SVR.JS 3.14.16 LTS + +* An attacker could send a HTTP forward proxy request with malformed URL not using CONNECT method to possibly crash the server. + ### Fixed in SVR.JS 3.13.0 and in SVR.JS 3.4.41 LTS * An attacker could use user name with newlines on HTTP authentication to inject false log entries. (introduced in SVR.JS 3.0.0)