rpms/nodejs22
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar)

Browse Source 
Fix for  Decompression/parse DoS via unlimited input in node-tar.
Fix for Node-tar: Denial of Service via malformed tar archive header.

Created by updating npm to 11.18 and filtering only for node-tar files.

Advisory:
 - https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
 - https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w

Resolves: RHEL-193864 RHEL-193828
This commit is contained in:
tjuhasz 2026-07-20 11:49:24 +02:00
parent 9651055244
commit 9ee24b1931
2 changed files with 491 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

490
0003-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch Normal file
View File

File diff suppressed because one or more lines are too long

1
nodejs22.spec
View File

@ -181,6 +181,7 @@ Patch: 0001-fips-disable-options.patch
Patch: 0001-CVE-2026-25547-braces-expansion.patch
# npm deps patches
Patch: 0002-CVE-2026-42338-npm-ip-address-security-fix.patch
Patch: 0003-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
%if 0%{?nodejs_default}
%global pkgname nodejs