From 5381106d1fb70137b97c95e755228647e9576132 Mon Sep 17 00:00:00 2001 From: Dorian Niemiec Date: Mon, 6 May 2024 12:49:57 +0200 Subject: [PATCH] Update SVR.JS to 3.15.0 and introduce SVR.JS LTS --- source/changelog.md | 12 ++++++++++++ source/docs.md | 2 +- source/index.md | 6 +++--- source/vulnerabilities.md | 4 ++++ 4 files changed, 20 insertions(+), 4 deletions(-) diff --git a/source/changelog.md b/source/changelog.md index b79752e..08ff03d 100644 --- a/source/changelog.md +++ b/source/changelog.md @@ -4,6 +4,18 @@ excerpt: Learn more about changes introduced in various SVR.JS versions. date: 2023-12-21 17:10:14 --- +## SVR.JS 3.14.16 LTS + +* Prevented DoS attacks performed with forward proxy HTTP requests with malformed URLs. + +## SVR.JS 3.15.0 + +* Changed URL parser from wrapper over WHATWG URL parser to custom regex-based URL parser. +* Optimized server code. +* Redesigned default error pages. +* Removed blocking file system calls from the directory listing function. +* Replaced _path.extname()_ function with regex-based function. + ## SVR.JS 3.14.15 * Fixed crashes related to the request ID generation. diff --git a/source/docs.md b/source/docs.md index d0ac232..a61eea5 100644 --- a/source/docs.md +++ b/source/docs.md @@ -1612,7 +1612,7 @@ Extension of resource defined in the request. Parsed _Url_ object created by _url.parse()_ method (includes parsed query string). -SVR.JS 3.3.1 and newer include hostname of the server (it uses wrapper over WHATWG URL API), older versions don't. +SVR.JS 3.3.1 and newer include hostname of the server (3.3.1 to 3.14.x use wrapper over WHATWG URL API; 3.15.0 and newer use custom URL parser), older versions don't. #### _search_ diff --git a/source/index.md b/source/index.md index 44177a2..c51be28 100644 --- a/source/index.md +++ b/source/index.md @@ -3,7 +3,7 @@ title: Main page date: 2024-01-21 19:41:01 layout: index-page sitemap: false -svrjsversion: 3.14.15 +svrjsversion: 3.15.0 ---
@@ -13,11 +13,11 @@ svrjsversion: 3.14.15

Host a webpage, run server-side JavaScript, use mods to expand server functionality, or use it as a forward or reverse proxy — all in SVR.JS! SVR.JS is a web server that runs on top of Node.JS, thus enabling server-side JavaScript on webpages. SVR.JS also has an integrated log viewer, log highlighter, and user management tool. SVR.JS can run not only on Node.JS but also in Bun (experimental support).

diff --git a/source/vulnerabilities.md b/source/vulnerabilities.md index 581d139..eb8e171 100644 --- a/source/vulnerabilities.md +++ b/source/vulnerabilities.md @@ -9,6 +9,10 @@ If you find a security issue with SVR.JS, report it as soon as possible to _vuln ## SVR.JS +### Fixed in SVR.JS 3.15.0 and in SVR.JS 3.14.16 LTS + +* An attacker could send a HTTP forward proxy request with malformed URL not using CONNECT method to possibly crash the server. + ### Fixed in SVR.JS 3.13.0 and in SVR.JS 3.4.41 LTS * An attacker could use user name with newlines on HTTP authentication to inject false log entries. (introduced in SVR.JS 3.0.0)