import UBI nodejs-22.23.1-2.module+el8.10.0+24556+e9352af2

SOURCES/0004-CVE-2026-13149-brace-expansion-unbound-recursion.patch

@@ -0,0 +1,100 @@
+From 213dc171de329a09f34c7a3222cad723ee65d693 Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Tue, 14 Jul 2026 08:27:05 +0000
+Subject: [PATCH] CVE-2026-13149: Fix unbound recursion in brace-expansion
+
+A run of non-expanding {} groups expanded post once per group before the
+early returns that never use it, doubling the work on every group. expand()
+ran in O(2^n) and blocked for minutes on a ~90 byte input.
+
+Defer expanding post until a brace set is known to expand, and turn the
+{a},b} restart into a loop so a long run of {} groups can't exhaust the
+call stack.
+
+Adapted from upstream TypeScript fix to the JavaScript version (2.0.2)
+vendored in Node.js.
+
+Upstream: https://github.com/juliangruber/brace-expansion/commit/c7e33ec
+---
+ .../npm/node_modules/brace-expansion/index.js | 49 ++++++++++++-------
+ 1 file changed, 32 insertions(+), 17 deletions(-)
+
+diff --git a/deps/npm/node_modules/brace-expansion/index.js b/deps/npm/node_modules/brace-expansion/index.js
+index d084bac4..5d5f61ff 100644
+--- a/deps/npm/node_modules/brace-expansion/index.js
++++ b/deps/npm/node_modules/brace-expansion/index.js
+@@ -99,21 +99,27 @@ function gte(i, y) {
+ function expand(str, max, isTop) {
+   var expansions = [];
+ 
+-  var m = balanced('{', '}', str);
+-  if (!m) return [str];
+-
+-  // no need to expand pre, since it is guaranteed to be free of brace-sets
+-  var pre = m.pre;
+-  var post = m.post.length
+-    ? expand(m.post, max, false)
+-    : [''];
+-
+-  if (/\$$/.test(m.pre)) {
+-    for (var k = 0; k < post.length && k < max; k++) {
+-      var expansion = pre+ '{' + m.body + '}' + post[k];
+-      expansions.push(expansion);
++  // The {a},b} rewrite below restarts expansion on a rewritten string with
++  // the same max and isTop = true. Loop instead of recursing so a long run
++  // of non-expanding {} groups can't exhaust the call stack.
++  for (;;) {
++    var m = balanced('{', '}', str);
++    if (!m) return [str];
++
++    // no need to expand pre, since it is guaranteed to be free of brace-sets
++    var pre = m.pre;
++
++    if (/\$$/.test(m.pre)) {
++      var post = m.post.length
++        ? expand(m.post, max, false)
++        : [''];
++      for (var k = 0; k < post.length && k < max; k++) {
++        var expansion = pre+ '{' + m.body + '}' + post[k];
++        expansions.push(expansion);
++      }
++      return expansions;
+     }
+-  } else {
++
+     var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
+     var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
+     var isSequence = isNumericSequence || isAlphaSequence;
+@@ -122,11 +128,20 @@ function expand(str, max, isTop) {
+       // {a},b}
+       if (m.post.match(/,(?!,).*\}/)) {
+         str = m.pre + '{' + m.body + escClose + m.post;
+-        return expand(str, max, true);
++        isTop = true;
++        continue;
+       }
+       return [str];
+     }
+ 
++    // Only expand post once we know this brace set actually expands. Computing
++    // it before the early returns above expanded post a second time on every
++    // non-expanding {}, which is what made inputs like a{},{},{}... blow up
++    // exponentially.
++    var post = m.post.length
++      ? expand(m.post, max, false)
++      : [''];
++
+     var n;
+     if (isSequence) {
+       n = m.body.split(/\.\./);
+@@ -200,8 +215,8 @@ function expand(str, max, isTop) {
+           expansions.push(expansion);
+       }
+     }
+-  }
+ 
+-  return expansions;
++    return expansions;
++  }
+ }
+ 

SPECS/nodejs.spec

@@ -67,7 +67,7 @@
 # This is used by both the nodejs package and the npm subpackage that
 # has a separate version - the name is special so that rpmdev-bumpspec
 # will bump this rather than adding .1 to the end.
-%global baserelease 1
+%global baserelease 2
 
 %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
@@ -226,6 +226,8 @@ Patch2: 0002-fips-disable-options.patch
 Patch3: 0001-CVE-2026-25547-braces-expansion.patch
 # npm deps patches
 Patch4: 0002-CVE-2026-42338-npm-ip-address-security-fix.patch
+Patch5: 0003-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
+Patch6: 0004-CVE-2026-13149-brace-expansion-unbound-recursion.patch
 
 %global pkgname nodejs
 
@@ -957,6 +959,11 @@ end
 
 
 %changelog
+* Thu Jul 23 2026 Jan Staněk <jstanek@redhat.com> - 1:22.23.1-2
+- Backport patches for various CVEs
+  Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
+  Resolves: RHEL-193842 RHEL-193874 RHEL-208661
+
 * Wed Jun 24 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.23.1-1
 - Update to version 22.23.1
   Resolves: RHEL-176170