Meteor security releases: 3.4.4, 3.5.5 and 3.6.1

announce releases
1

Meteor security updates for versions 3.4.4, 3.5.5, and 3.6.1, including Node.js and Meteor security fixes. Review the migration notes before updating.
Meteor security updates for versions 3.4.4, 3.5.5, and 3.6.1, including Node.js and Meteor security fixes. Review the migration notes before updating.1672×941 91.9 KB

Hi everyone!

Meteor 3.4.4, 3.5.5, and 3.6.1 are now available. Each patch brings security fixes for Meteor and an updated Node.js runtime to its release line. This batch follows the October security releases.

Highlights

Node.js security updates

Meteor’s dev bundles include the November 11 Node.js security fixes. Each release stays on its current Node.js major version. If you pin Node.js separately in production, update that runtime to the version listed below when you rebuild and redeploy. Node.js security advisory

Security fixes in Meteor

  • Accounts and DDP. Email verification tokens expire after three days by default, production OAuth setup has tighter controls, and malformed DDP messages are rejected without stalling connections.
  • MongoDB. Meteor falls back to polling for selectors it cannot safely evaluate locally. Check query load after updating if your app relies on those selectors.
  • Installer, build tools, and Cordova. Archive extraction checks paths and links against their intended directories. The Cordova webapp plugin rejects unsafe asset paths, and fixes in HMR and legacy deploy tooling reduce exposure of credentials and deployment settings.

Update within your release line

Run the update command from your app directory to pick up the patched runtime and Meteor packages together.

Current line Release notes Bundled Node.js Update an existing app Create a new app
3.4.x 3.4.4 22.23.5 meteor update --release 3.4.4 meteor create my-app --release 3.4.4
3.5.x 3.5.5 24.22.3 meteor update --release 3.5.5 meteor create my-app --release 3.5.5
3.6.x 3.6.1 26.13.1 meteor update --release 3.6.1 meteor create my-app --release 3.6.1

What to check when upgrading

  • OAuth setup. Configure production OAuth services on the server or through settings. Apps that intentionally configure services from the client need to opt in on the server with allowClientServiceConfiguration.
  • Separate API origins on 3.5.5 and 3.6.1. If accounts-express automatically sends credentials to a trusted API on another origin, list it in authFetchAllowedOrigins.
  • HttpOnly login cookies on 3.5.5. Enable them on both the client and server. Review your allowed origins and the endpoint rate limit in the release notes.

Thanks to everyone who reported issues, reviewed patches, or helped test the releases. If you hit an upgrade regression, reply here with your previous Meteor version, operating system, and a minimal reproduction if you have one. Please send suspected vulnerabilities privately to security@meteor.com. Meteor security policy

2 Likes