January 8th, 2018
Project zero has recently announced some new attacks that have received a lot of attention:https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html.
The risk from these attacks to systems running Node.js resides in the systems in which your Node.js applications run, as opposed to the Node.js runtime itself. The trust model for Node.js assumes you are running trusted code and does not provide any separation between code running within the runtime itself. Therefore, untrusted code that would be necessary to execute these attacks in Node.js could already affect the execution of your Node.js applications in ways that are more severe than possible through these new attacks.
The current Node.js security policy can be found at https://nodejs.org/en/security/.
Please contact firstname.lastname@example.org if you wish to report a vulnerability in Node.js.
Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organisation.