●Change8

Migrating to Node.js v20.19.2

Version v20.19.2 introduces 2 breaking changes. This guide details how to update your code.

Released: 5/14/2025

2
Breaking Changes
3
Migration Steps
5
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

llhttpuv_fs_req_cleanupcryptofshttp

Breaking Changes

●Issue #1

The update to llhttp 9.2.0 is marked as SEMVER-MAJOR and may introduce breaking changes in HTTP parsing behavior.

●Issue #2

OBS (Obsolete Line Folding) in HTTP headers is now disallowed by default (CVE-2024-27982).

Migration Steps

  1. 1
    Update Node.js to the latest version to apply security patches.
  2. 2
    Verify that incoming HTTP requests do not rely on Obsolete Line Folding (OBS fold) in headers, as these will now be rejected by default.
  3. 3
    Test HTTP parsing logic against the new llhttp 9.2.0 requirements.

Release Summary

This security release addresses multiple vulnerabilities (CVE-2025-23166, CVE-2025-23167, CVE-2025-23165, CVE-2024-27982) by updating the llhttp parser and fixing critical issues in the crypto and fs modules.

Need More Details?

View the full release notes and all changes for Node.js v20.19.2.

View Full Changelog