CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

www/node 24.22.1

V8 JavaScript for client and server (meta port)

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 24.21.0_3, update to 24.22.1 not built yet
Upstream
up to date
Last update
to 24.22.1 · ba74741313
Quarterly
2026Q4: 24.21.0_3 · last MFH 5355d058d8
Formerly
www/node7 until 2016-12-07, www/iojs until 2015-09-23
WWW
https://nodejs.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install node
installs 24.21.0_3 from latest; from quarterly (2026Q4) 24.21.0_3
Port
# cd /usr/ports/www/node && make install clean
Size
1.2 KiB download · 243 B installed
Depends on
www/node24 24.21.0_3
License
NA

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1624.21.0_324.21.0_3–
FreeBSD 1524.21.0_324.21.0_3–
FreeBSD 1424.21.0_324.21.0_324.21.0_3

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1524.21.0_324.21.0_3–
FreeBSD 1424.21.0_324.21.0_324.21.0_3

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (0)

The CVE record lists the packaged version 24.21.0_3 as affected, and no VuXML entry names the CVE. What does this mean?

None.

VuXML only (1)

Listed in VuXML, the packaged version 24.21.0_3 is still in the affected range; pkg audit reports it. What does this mean?

Fixed (30)

Show 30 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (436)

Kurt Jaeger (pi) · 6.9.1_1
www/node7: Add Node.js 7.1.0, copied from www/node

PR:		213945
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
de9a67ce39
Jan Beich (jbeich) · 6.9.1_1
devel/icu: update to 58.1

Changes:	http://site.icu-project.org/download/58
PR:		214384
Exp-run by:	antoine
Approved by:	office (bapt)
23a96f4a5f
Kurt Jaeger (pi) · 6.9.1
www/node: Copy to www/node6 as LTS version

PR:		213693
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
acac5de6df
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.9.1
- Remove unnecessary +

Approved by:	portmgr (blanket)
f6fcca37b6
Mark Felder (feld) · 6.9.1
www/node: Update to 6.9.1

Bump to the latest upstream 6.x release. Node.js v6 is now an LTS
release, see the v6.9.0 release announcement for details. The v6.9.0
release was also a security release, while v6.9.1 fixes a regression
introduced in v6.8.0.

Cleanup clang vs. gcc handling by using USES=compiler:c++-lib

https://nodejs.org/en/blog/release/v6.9.0/
https://nodejs.org/en/blog/release/v6.9.1/
https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/

PR:		213604
Security:	CVE-2016-5180
a8538725d2
Adam Weinberger (adamw) · 6.8.0
Update to 6.8.0.

PR:		213432
Submitted by:	maintainer (Bradley T. Hughes)
823ec3b701
Vanilla I. Shu (vanilla) · 6.7.0
Update to 6.7.0.

PR:		213070
Submitted by:	maintainer
39a91307a4
Tijl Coosemans (tijl) · 6.6.0_1
- Update devel/icu to 57.1. - Clean up the Makefile. - Follow some upstream recommendations (--with-data-packaging=archive,   --disable-renaming, -DICU_NO_USER_DATA_OVERRIDE). - Patch makefiles to install static libraries with INSTALL_DATA so they   aren't stripped. - Patch config/mh-bsd-gcc to sync with config/mh-linux-gcc. - Fix endianness detection in ICU.  The code wanted to use BYTE_ORDER   d

PR:		205120
Exp-run by:	antoine
Approved by:	portmgr (antoine)
48f4591035
Vanilla I. Shu (vanilla) · 6.6.0
Update to 6.6.0.

PR:		212797
Submitted by:	maintainer
2fcd2aa4af
Dmitry Marakasov (amdmi3) · 6.5.0
- Update to 6.5.0

PR:		212250
Submitted by:	bradleythughes@fastmail.fm (maintainer)
9bb24e9066
Pawel Pekala (pawel) · 6.4.0
Update to version 6.4.0

Changelog:
https://nodejs.org/en/blog/release/v6.4.0/

PR:		211982
Submitted by:	Bradley T. Hughes (maintainer)
2d760cd7d0
Pawel Pekala (pawel) · 6.3.1
Update to version 6.3.1

PR:		211287
Submitted by:	Bradley T. Hughes (maintainer)
33ae756105
Mathieu Arnold (mat) · 6.3.0
Stop people putting arguments to USES=ssl.

Sponsored by:	Absolight
507c83b05b
Kurt Jaeger (pi) · 6.3.0
www/node: 6.2.2 -> 6.3.0

- buffer: Added buffer.swap64() to complement swap16() & swap32().
- build: New configure options have been added for building Node.js as
  a shared library.
  o The options are: --shared, --without-v8-platform & --without-bundled-v8.
- crypto: Root certificates have been updated.
- debugger: The server address is now configurable via
  --debug=<address>:<port>.
- npm: Upgraded npm to v3.10.3
- readline: Added the prompt option to the readline constructor.
- repl / vm: sigint/ctrl+c will now break out of infinite loops without
  stopping the Node.js instance.
- src:
  o Added a node::FreeEnvironment public C++ API.
  o Refactored require('constants'), constants are now available
    directly from their respective modules. (James M Snell) #6534
- stream: Improved readable.read() performance by up to 70%.
- timers: setImmediate() is now up to 150% faster in some situations.
- util: Added a breakLength option to util.inspect() to control how
  objects are formatted across lines.
- v8-inspector: Experimental support has been added for debugging
  Node.js over the inspector protocol.
  o Note: This feature is experimental, and it could be altered or removed.
  o You can try this feature by running Node.js with the --inspect flag.

PR:		210893
Changes:	https://nodejs.org/en/blog/release/v6.3.0/
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
ad9159b0d8
Kurt Jaeger (pi) · 6.2.2_4
www/node[4]: Fix OpenSSL dependencies after USES=ssl changes

PR:		210891
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
96df585c66
Kurt Jaeger (pi) · 6.2.2_3
www/node[4]: Use NLS option to enable system-icu

PR:		210786
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
97dfec1387
Mathieu Arnold (mat) · 6.2.2_2
Bump PORTREVISION for the icu revert.

This time not bumping lang/php70, but devel/php70-intl which is the one
really depending on icu.

PR:		205120
With hat:	portmgr
Sponsored by:	Absolight
7acca7e902
Pietro Cerutti (gahr) · 6.2.2_1
devel/icu: bump PORTREVISION on missing dependent ports

Reported by:	rakuco
a32c042bc8
Kurt Jaeger (pi) · 6.2.2
www/node: 6.2.1 -> 6.2.2

- http:
  o req.read(0) could cause incoming connections to stall and time out
    under certain conditions. (Fedor Indutny) #7211
  o When freeing the socket to be reused in keep-alive Agent wait for both
    prefinish and end events. Otherwise the next request may be written
    before the previous one has finished sending the body, leading to
    parser errors. (Fedor Indutny) #7149
- npm:
  o upgrade npm to 3.9.5 (Kat Marchan) #7139 (not relevant)

PR:		210518
Changes:	https://nodejs.org/en/blog/release/v6.2.2/
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
bdeb2c4710
Kurt Jaeger (pi) · 6.2.1_3
www/node: regenerate patches with 'make makepatch'

PR:		210619
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
9b3c997cb8
Kurt Jaeger (pi) · 6.2.1_3
www/node[45]: work around build breakages due to include path ordering

Add a post-configure step to strip out all occurrences of
-I${LOCALBASE}/include. Rely instead on USES+=localbase to tell the
compiler where to find includes from external dependencies.

After r416894, node.js builds will use external dependencies instead of
bundled ones. Fallout from this changes includes several build
breakages. All come from the fact that the node-gyp build process adds
-I${LOCALBASE}/include to CFLAGS before all others, including its own
bundled dependencies. This causes the build to incorrectly pick up
include files from any packages in ${LOCALBASE}, rather than the bundled
libraries as intended.

PR:		210618
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
b8b1a39d25
Mathieu Arnold (mat) · 6.2.1_3
Remove all usage of OPENSSL_PORT from ports, this is deprecated, and always was a user defined variable.

Sponsored by:	Absolight
61155ffd86
Adam Weinberger (adamw) · 6.2.1_3
Revert part of r417063 that wasn't supposed to be committed. It removed a -I/usr/local/include, but it's present elsewhere in the CFLAGS so it doesn't change the final product.

PR:		210400
Submitted by:	maintainer (Bradley T. Hughes)
0bcf8c1676
Kurt Jaeger (pi) · 6.2.1_3
www/node, www/node[45]: Depend on devel/icu instead of the bundled icu-small

PR:		210333
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
Reviewed by:	w.schwarzenfeld@utanet.at
0afdf49065
Alan Somers (asomers) · 6.2.1_2
Change python from a run to a build dep of www/node

Change python from a run to a build dep of www/node. The current version of
node doesn't install any Python files.

PR:		210309
Reviewed by:	Bradley T. Hughes (Maintainer)
Approved by:	pi (ports)
Sponsored by:	Spectra Logic Corp
Differential Revision:	https://reviews.freebsd.org/D6699
238dc6b76a
Adam Weinberger (adamw) · 6.2.1_1
Prefer external libraries to the ones bundled with node.

Do not statically link bundled libraries into node.js. It requires
openssl 1.0.2, so pull that in from ports when the base version is not
new enough. While all versions use c-ares, only www/node has a configure
knob to enable building against an unbundled version. All other
dependencies are specified in www/node/common.mk and used by all 3
ports.

node cannot build against LibreSSL, so if it's the chosen SSL provider,
the BUNDLED_SSL option must be enabled.

The www/node010 and www/node012 ports have not been done since both are
deprecated and have very old bundled dependencies that are not available
in ports.

PR:		209793
Submitted by:	Bradley T. Hughes (maintainer)
087e807c6c
Bartek Rutkowski (robak) · 6.2.1
www/node: update 6.2.0 -> 6.2.1

PR:		210072
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
d956fc1d8a
Kurt Jaeger (pi) · 6.2.0
www/node: add armv6 support

PR:		209481
Submitted by:	mikael.urankar@gmail.com
Approved by:	bradleythughes@fastmail.fm (maintainer)
622b706c15
Adam Weinberger (adamw) · 6.2.0
Update to 6.2.0.

PR:		209600
Submitted by:	maintainer (Bradley T. Hughes)
a5abc29f17
Kurt Jaeger (pi) · 6.1.0
www/node: 6.0.0 -> 6.1.0

Update to the latest upstream v6.x current release after the recent
openssl CVEs. This release also includes several semver minor changes.

Release announcment with changelog is here:
  https://nodejs.org/en/blog/release/v6.1.0/
  https://nodejs.org/en/blog/vulnerability/openssl-may-2016/

PR:		209342
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
643b1116ef
Kurt Jaeger (pi) · 6.0.0
www/node: 5.11.0 -> 6.0.0 New port: www/node5, to ease migration from node-5.x to node-6.x

This new major version of Node.js delivers significant improvements
in performance, reliability, usability and security. Module loading
is nearly four times faster than in Node.js v4, tests and documentation
have seen significant improvements, usability of the Buffer and
File System APIs have been improved, and Node.js now supports 93%
of ES6 language features, thanks to V8 version 5.0.

The full release announcement can be read here:
https://nodejs.org/en/blog/release/v6.0.0/

The full changelog is available on Github:
https://github.com/nodejs/node/commit/ce3e3c5fe15479475c068482c48eb9cbf1ac9df5

For node5:
node.js v5.x will only be supported for a few months to give people
time to move to v6. This new port is marked as deprecated with an
expiration date of July 1, allowing all of May and June to transition.
See https://nodejs.org/en/blog/release/v6.0.0/#what-about-node-js-v5

PR:		209215, 209216
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
9ea0e602a6
Bartek Rutkowski (robak) · 5.11.0
www/node: update 5.10.1 -> 5.11.0

PR:		208974
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
e7efd15303
Kurt Jaeger (pi) · 5.10.1
www/node: really change maintainer

PR:		208587
Submitted by:	lwhsu
64cefd9eb0
Kurt Jaeger (pi) · 5.10.1
www/node: 5.9.1 -> 5.10.1

- lots of small fixes
- submitter becomes maintainer

PR:             208587
Submitted by:   Bradley T. Hughes <bradleythughes@fastmail.fm>
Approved by:    Daniel Lin <linpct@gmail.com> (maintainer)
d61a9eaedd
Dimitry Andric (dim) · 5.9.1
During the exp-run in bug 208158, it was found that www/node gives errors with libc++ 3.8.0 [1]:

/usr/include/c++/v1/map:837:5: error: static_assert failed "Allocator::value_type must be same type as value_type"
    static_assert((is_same<typename allocator_type::value_type, value_type>::value),
    ^             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../deps/v8/src/compiler/js-type-feedback.h:41:21: note: in instantiation of template class 'std::__1::map<unsigned int, v8::internal::TypeFeedbackId, std::__1::less<unsigned int>, v8::internal::zone_allocator<v8::internal::TypeFeedbackId> >' requested here
  TypeFeedbackIdMap type_feedback_id_map_;
                    ^

This is because libc++ 3.8.0 has added these sanity checks for custom
std::map allocators, which *must* be of the type std::pair<const Key,
Value>.  I fixed the few std::map instances in the node source by adding
this to their allocator types.

Approved by:	linpct@gmail.com (maintainer)
PR:		208270
MFH:		2016Q2
1a5396aa84
Dmitry Marakasov (amdmi3) · 5.9.1
- Update to 5.9.1

PR:		208376
Submitted by:	bradleythughes@fastmail.fm
Approved by:	linpct@gmail.com (maintainer)
0715aba2a4
Lars Engels (lme) · 5.9.0
Update to 5.9.0

PR:		208096
Submitted by:	Bradley T. Hughes
Approved by:	maintainer
c6f4da509a
Mark Felder (feld) · 5.8.0
www/node: Update to 5.8.0

PR:		207832
Approved by:	maintainer
2d4a834bfc
Mark Felder (feld) · 5.7.1
www/node: Update to 5.7.1

Changelog:	https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac

PR:		207832
Security:	CVE-2016-0702
Security:	CVE-2016-0705
Security:	CVE-2016-0797
MFH:		2016Q1
1db7641578
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.7.0
- Fix USES=python: it does not build with Python 3

Approved by:	portmgr (blanket)
With hat:	python
644abf421a
Vanilla I. Shu (vanilla) · 5.7.0
Update to 5.7.0.

PR:		207473
Submitted by:	maintainer
62031df73d
Vanilla I. Shu (vanilla) · 5.6.0
Update to 5.6.0.

PR:		207203
Submitted by:	maintainer
507d1991f5
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.5.0
- Update to 5.5.0

Changes:	https://github.com/nodejs/node/blob/master/CHANGELOG.md
PR:		206628
Submitted by:	Daniel Lin <linpct@gmail.com> (maintainer)
4885e21791
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.4.1
- Update to 5.4.1

Changes:	https://github.com/nodejs/node/blob/master/CHANGELOG.md
PR:		206222
Submitted by:	Daniel Lin <linpct@gmail.com> (maintainer)
Sponsored by:	PortsCamp Taiwan
f0f41ff8aa
Kubilay Kocak (koobs) · 5.2.0_1
www/node: Fix build on FreeBSD 9.x

Patch log-utils.h in the in-tree v8 source code, allowing it to compile
using G++ 4.8 on FreeBSD 9.x. The code unfortunately relies on compiler
intrinsics instead of including the necessary standard headers for
handling C-style I/O and variadic arguments in its internal logging
functions.

This commit log and the code changes were provided by:

Brendan Molloy (fmtq via IRC) - Thank you!

PR:		205401
Reported by:	JSG (via freenode IRC)
Approved by:	blanket (portmgr)
93250d6ba2
Kubilay Kocak (koobs) · 5.2.0
www/node: Update to 5.2.0, Create www/node4, Update to 4.2.3

www/node:

 * Update PORTVERSION and distinfo checksum (5.2.0) [1]
 * Add CONFLICTS to www/node4

www/node4:

 * Create www/node4 port for LTS users
 * Update www/node4 to 4.2.3 [2]
 * Add CONFLICTS to www/node

* Add UPDATING entry for users wishing to remain on LTS (4.x)

Based on:

PR:		204653 [1][2]
Submitted by:	Randy Westlund <rwestlun gmail com> [1][2]
Approved by:	maintainer <linpct gmail com>
7ddbb58780
Sunpoet Po-Chuan Hsieh (sunpoet) · 4.2.1
- Add LICENSE_FILE

Approved by:	portmgr (blanket)
167ed8698d
Gerald Pfeifer (gerald) · 4.2.1
Replace USE_GCC=4.8+ by USE_GCC=yes.  Both are equivalent as of today, and generally we want to use the default version of GCC in cases like these.

Approved by:	portmgr blanket
9c88366292
Wen Heping (wen) · 4.2.1
- Update to 4.2.1

PR:		203763
Submitted by:	wen@(myself)
Approved by:	linpct@gmail.com(maintainer)
20df8ba912
Emanuel Haupt (ehaupt) · 4.1.2
Update to 4.1.2

PR:		203657
Approved by:	linpct@gmail.com (maintainer)
5f28095231