---
date: '2014-10-23T19:12:33.000Z'
category: release
title: Node.js 0.10.33 (Stable)
layout: blog-post
author: The Node.js Project
---

This release handles the recent POODLE vulnerability by disabling SSLv2/SSLv3
by default for the most predominate uses of TLS in Node.js.

It took longer than expected to get this release accomplished in a way that
would provide appropriate default security settings, while minimizing the
surface area for the behavior change we were introducing. It was also important
that we validated that our changes were being applied in the variety of
configurations we support in our APIs.

With this release, we are confident that the only behavior change is that of
the default allowed protocols do not include SSLv2 or SSLv3. Though you are
still able to programatically consume those protocols if necessary.

Included is the documentation that you can find at
<https://nodejs.org/api/tls.html#tls_protocol_support> that describes how this
works going forward for client and server implementations.

---

Node.js is compiled with SSLv2 and SSLv3 protocol support by default, but these
protocols are **disabled**. They are considered insecure and could be easily
compromised as was shown by [CVE-2014-3566](https://nvd.nist.gov/vuln/detail/cve-2014-3566). However, in some situations, it
may cause problems with legacy clients/servers (such as Internet Explorer 6).
If you wish to enable SSLv2 or SSLv3, run node with the `--enable-ssl2` or
`--enable-ssl3` flag respectively. In future versions of Node.js SSLv2 and
SSLv3 will not be compiled in by default.

There is a way to force node into using SSLv3 or SSLv2 only mode by explicitly
specifying `secureProtocol` to `'SSLv3_method'` or `'SSLv2_method'`.

The default protocol method Node.js uses is `SSLv23_method` which would be more
accurately named `AutoNegotiate_method`. This method will try and negotiate
from the highest level down to whatever the client supports. To provide a
secure default, Node.js (since v0.10.33) explicitly disables the use of SSLv3
and SSLv2 by setting the `secureOptions` to be
`SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2` (again, unless you have passed
`--enable-ssl3`, or `--enable-ssl2`, or `SSLv3_method` as `secureProtocol`).

If you have set `securityOptions` to anything, we will not override your
options.

The ramifications of this behavior change:

- If your application is behaving as a secure server, clients who are `SSLv3`
  only will now not be able to appropriately negotiate a connection and will be
  refused. In this case your server will emit a `clientError` event. The error
  message will include `'wrong version number'`.
- If your application is behaving as a secure client and communicating with a
  server that doesn't support methods more secure than SSLv3 then your connection
  won't be able to negotiate and will fail. In this case your client will emit a
  an `error` event. The error message will include `'wrong version number'`.

---

2014.10.20, Version 0.10.33 (Stable)

- openssl: Update to 1.0.1j (Addressing multiple CVEs)

- uv: Update to v0.10.29

- child_process: properly support optional args (cjihrig)

- crypto: Disable autonegotiation for SSLv2/3 by default (Fedor Indutny,
  Timothy J Fontaine, Alexis Campailla)

This is a behavior change, by default we will not allow the negotiation to
SSLv2 or SSLv3. If you want this behavior, run Node.js with either
`--enable-ssl2` or `--enable-ssl3` respectively.

This does not change the behavior for users specifically requesting
`SSLv2_method` or `SSLv3_method`. While this behavior is not advised, it is
assumed you know what you're doing since you're specifically asking to use
these methods.

Source Code: https://nodejs.org/dist/v0.10.33/node-v0.10.33.tar.gz

Macintosh Installer (Universal): https://nodejs.org/dist/v0.10.33/node-v0.10.33.pkg

Windows Installer: https://nodejs.org/dist/v0.10.33/node-v0.10.33-x86.msi

Windows x64 Installer: https://nodejs.org/dist/v0.10.33/x64/node-v0.10.33-x64.msi

Windows x64 Files: https://nodejs.org/dist/v0.10.33/x64/

Linux 32-bit Binary: https://nodejs.org/dist/v0.10.33/node-v0.10.33-linux-x86.tar.gz

Linux 64-bit Binary: https://nodejs.org/dist/v0.10.33/node-v0.10.33-linux-x64.tar.gz

Solaris 32-bit Binary: https://nodejs.org/dist/v0.10.33/node-v0.10.33-sunos-x86.tar.gz

Solaris 64-bit Binary: https://nodejs.org/dist/v0.10.33/node-v0.10.33-sunos-x64.tar.gz

Other release files: https://nodejs.org/dist/v0.10.33/

Website: https://nodejs.org/docs/v0.10.33/

Documentation: https://nodejs.org/docs/v0.10.33/api/

Shasums:

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

03e72005a4ed612aa7a984d840f148bfb76f3c5f  node-v0.10.33-darwin-x64.tar.gz
f40319ad8720d350ea45e56d5d9018c244482ddc  node-v0.10.33-darwin-x86.tar.gz
4eba69caf7368d7f388700eb02996f85b06f457a  node-v0.10.33-linux-x64.tar.gz
62a58b74851350a935e781d216484966b04ae097  node-v0.10.33-linux-x86.tar.gz
aea7f541e21b57a07b15ab8d825c43f04a2f7440  node-v0.10.33-sunos-x64.tar.gz
97b1d889a299afd6f0c0bb320646d92b7c498d01  node-v0.10.33-sunos-x86.tar.gz
8a637d14609208d31fe466cd4961bec58a8f8f9b  node-v0.10.33-x86.msi
81fcb80d7181768a7211a337c084b4a0b139dd74  node-v0.10.33.pkg
69aeeade5fef622c3150cfc2b4a8f70eea1ef1ec  node-v0.10.33.tar.gz
69275030a0549c27189a8f25396997deb70462ad  node.exe
13dc334420abeaab9b7b3d184e0c5126250ce4e7  node.exp
0379528f6d65eef73ceaeaf9acfe327648a9bc83  node.lib
c23021453a5331954929cff26f7a7f5131af4351  node.pdb
0fe937289a228a5bbc4fc97664eabbdc3a9792e5  openssl-cli.exe
e1cff728f900bda134973666f75aae52a2d60e86  openssl-cli.pdb
6173345fb3c8388abb2a415b99bb4962ebd8e123  x64/node-v0.10.33-x64.msi
a4142d8a122317cc2e32caa643def2797e5f2cd7  x64/node.exe
e067c6d6904a15a494b6b9f3e84cb07dc738c2ea  x64/node.exp
63567e086a965f3ae452b6caace401592cd8c0ec  x64/node.lib
e2cedfc1dd02f1d365314b162167ffb12d1cb0b1  x64/node.pdb
68d60b60f03e703184a10d0a6adff69d9302b93e  x64/openssl-cli.exe
4cd9e8bcf4fa9134a2e84473ec3d7d4b4cd31013  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iEYEARECAAYFAlRJUxYACgkQfTP/nQJGQG2eNwCdGAIzkYTGHFohi2PVWKIKYmmq
bvoAnAulTmcNMMLlXi1+Nmtt5SGyZIL8
=0QtW
-----END PGP SIGNATURE-----
```
