2 ms·

So it appears that Node is vulnerable to the bug because Google won't backport the fix: https://github.com/joyent/node/blob/master/deps/v8/src/heap/mark-compac

• inglor 12y ago
  In Google's defence - they have stated they won't support versions of v8 that reached end of life and have announced they're supporting io.js in favor of node. I totally get why Google won't backport fixes like this. Google is actively helping io.js and development is coordinated.
  • apaprocki 12y ago
    To be clear, I find it annoying Google is not yet making the bug public even though the fix and test driver are available. Since they aren't going to patch the v8 in Node, I'd think Node users would really like to know if they are vulnerable to this and should manually patch it. stares at Joyent