Download Node.js 4.1.1

Node.js is open source and platform independent and is focused on developing server-side web applications. Those applications are written in JavaScript and run within the Node.js runtime on the server. It offers an event-driven environment where non-blocking I/O has been an important starting point. For more information, we refer you to this page. The development team has released version 4.1.1 with the following changes:

Node v4.1.1 (Stable)

This release contains some minor security-related updates. You are advised to upgrade to 4.1.1 if you are currently running v4.1.0.

Notable changes:

• buffer: Fixed a bug introduced in v4.1.0 where allocating a new zero-length buffer can result in the next allocation of a TypedArray in JavaScript not being zero-filled. In certain circumstances this could result in data leakage via reuse of memory space in TypedArrays, breaking the normally safe assumption that TypedArrays should be always zero-filled. (Trevor Norris) #2931.
• http: Guard against response-splitting of HTTP trailing headers added via response.addTrailers() by removing new-line ([\r\n]) characters from values. Note that standard header values ​​are already stripped of new-line characters. The expected security impact is low because trailing headers are rarely used. (Ben Noordhuis) #2945.
• npm: Upgrade to npm 2.14.4 from 2.14.3, see release notes for full details (Kat Marchán) #2958
  • Upgrades graceful-fs on multiple dependencies to no longer rely on monkey-patching fs
  • Fix npm link for pre-release / RC builds of Node
• v8: Update post-mortem metadata to allow post-mortem debugging tools to find and inspect:
  • JavaScript objects that use dictionary properties (Julien Gilli) #2959
  • ScopeInfo and thus closures (Julien Gilli) #2974

Known issues

See for complete and current list of known issues.

• Some problems with unreferenced timers running during beforeExit are still to be resolved. See #1264.
• Surrogate pair in REPL can freeze terminal. #690
• Calling dns.setServers() while a DNS query is in progress can cause the process to crash on a failed assertion. #894
• url.resolve may transfer the auth portion of the url when resolving between two full hosts, see #1435.

commit

• [d63e02e08d] – buffer: don’t set zero fill for zero-length buffer (Trevor Norris) #2931
• [5905b14bff] – build: fix icutrim when building small-icu on BE (Stewart Addison) #2602
• [f010cb5d96] – configure: detect mipsel host (Jérémy Lal) #2971
• [b93ad5abbd] – deps: backport 357e6b9 from V8’s upstream (Julien Gilli) #2974
• [8da3da4d41] – deps: backport ff7d70b from V8’s upstream (Julien Gilli) #2959
• [2600fb8ae6] – deps: upgraded to [email protected] in npm (Kat Marchán) #2958
• [793aad2d7a] – deps: upgrade to npm 2.14.4 (Kat Marchán) #2958
• [43e2b7f836] – doc: remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921
• [9c59d2f16a] – doc: remove extra using v8::HandleScope statement (Christopher J. Brody) #2983
• [f7edbab367] – doc: clarify description of assert.ifError() (Rich Trott) #2941
• [b2ddf0f9a2] – doc: refine process.kill() and exit explanations (Rich Trott) #2918
• [f68fed2e6f] – http: remove redundant code in _deferToConnect (Malcolm Ahoy) #2769
• [f542e74c93] – http: guard against response splitting in trailers (Ben Noordhuis) #2945
• [bc9f629387] – http_parser: do not dealloc during kOnExecute (Fedor Indutny) #2956
• [1860e0cebd] – lib,src: remove usage of events.EventEmitter (Sakthipriyan Vairamani) #2921
• [d4cd5ac407] – readline: fix tab completion bug (Matt Harrison) #2816
• [9760e04839] – repl: don’t use tty control codes when $TERM is set to “dumb” (Salman Aljammaz) #2712
• [cb971cc97d] – repl: backslash bug fix (Sakthipriyan Vairamani) #2968
• [2034f68668] – src: honor –abort_on_uncaught_exception flag (Evan Lucas) #2776
• [0b1ca4a9ef] – src: Add ABORT macro (Evan Lucas) #2776
• [4519dd00f9] – test: test sync version of mkdir & rmdir (Sakthipriyan Vairamani) #2588
• [816f609c8b] – test: use tmpDir instead of fixtures in readdir (Sakthipriyan Vairamani) #2587
• [2084f52585] – test: test more http response splitting scenarios (Ben Noordhuis) #2945
• [fa08d1d8a1] – test: add test-spawn-cmd-named-pipe (Alexis Campailla) #2770
• [71b5d80682] – test: make cluster tests more time tolerant (Michael Dawson) #2891
• [3e09dcfc32] – test: update cwd-enoent tests for AIX (Imran Iqbal) #2909
• [6ea8ec1c59] – tools: single, cross-platform tick processor (Matt Loring) #2868