rpms/nodejs24
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to version 24.19.0

Browse Source 
CVE fixes included in rebase:
CVE-2026-56846 - http2: retained headers can bypass maxSessionMemory limits,
 allowing remote memory exhaustion
CVE-2026-56848 - http2: re-entrant send during nghttp2_session_mem_recv() can
 cause heap-use-after-free
CVE-2026-58043 - permission: path matching can over-grant filesystem access
 across radix-tree prefix boundaries
 Blog: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Also following CVEs with lower severity:
CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042,
CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044

Regenerate tar CVE patch (0001-CVE-2026-59873-CVE-2026-59874) against
24.19.0 base, which ships tar 7.5.16 instead of 7.5.15.

Disable LTO (--enable-lto) to fix segfault at startup caused by
miscompilation with the new snapshot-in-libnode build changes in 24.19.0.

Remove wasm-allocation test from test list: the test requires RLIMIT_AS
set to 20GB to trigger OOM on WebAssembly.Memory allocations, which the
RPM build environment does not enforce.

Resolves: RHEL-234904 RHEL-234828 RHEL-234382
This commit is contained in:
tjuhasz 2026-08-17 14:48:52 +02:00
parent fa3b1f9e38
commit cafce37fa3
4 changed files with 111 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

142
0001-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
View File

File diff suppressed because one or more lines are too long

52
nodejs24.spec
View File

@ -1,6 +1,6 @@
Name: nodejs24
Epoch: 1
Version: 24.18.0
Version: 24.19.0
Release: %{autorelease}
Summary: JavaScript runtime
@ -24,45 +24,45 @@ URL: https://nodejs.org
# expect anything between the markers to be overwritten on any update.
# BEGIN automatic-version-macros # DO NOT REMOVE THIS LINE!
# Version from node-v24.18.0/src/node_version.h
# Version from node-v24.19.0/src/node_version.h
%global node_soversion 137
# Version from node-v24.18.0/deps/ada/ada.h
# Version from node-v24.19.0/deps/ada/ada.h
%nodejs_define_version ada 3.4.4
# Version from node-v24.18.0/deps/brotli/c/common/version.h
# Version from node-v24.19.0/deps/brotli/c/common/version.h
%nodejs_define_version brotli 1.2.0
# Version from node-v24.18.0/deps/cares/include/ares_version.h
# Version from node-v24.19.0/deps/cares/include/ares_version.h
%nodejs_define_version c_ares 1.34.6
# Version from node-v24.18.0/deps/histogram/include/hdr/hdr_histogram_version.h
# Version from node-v24.19.0/deps/histogram/include/hdr/hdr_histogram_version.h
%nodejs_define_version histogram 0.11.9
# Version from node-v24.18.0/tools/icu/current_ver.dep
# Version from node-v24.19.0/tools/icu/current_ver.dep
%nodejs_define_version icu 78.3 -p
# Version from node-v24.18.0/deps/uv/include/uv/version.h
# Version from node-v24.19.0/deps/uv/include/uv/version.h
%nodejs_define_version libuv 1.52.1
# Version from node-v24.18.0/deps/llhttp/include/llhttp.h
%nodejs_define_version llhttp 9.4.2
# Version from node-v24.18.0/deps/merve/merve.h
# Version from node-v24.19.0/deps/llhttp/include/llhttp.h
%nodejs_define_version llhttp 9.4.3
# Version from node-v24.19.0/deps/merve/merve.h
%nodejs_define_version merve 1.2.2
# Version from node-v24.18.0/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
# Version from node-v24.19.0/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
%nodejs_define_version nghttp2 1.69.0
# Version from node-v24.18.0/deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
# Version from node-v24.19.0/deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
%nodejs_define_version nghttp3 1.14.0
# Version from node-v24.18.0/deps/ngtcp2/ngtcp2/lib/includes/ngtcp2/version.h
# Version from node-v24.19.0/deps/ngtcp2/ngtcp2/lib/includes/ngtcp2/version.h
%nodejs_define_version ngtcp2 1.15.1
# Version from node-v24.18.0/lib/punycode.js
# Version from node-v24.19.0/lib/punycode.js
%nodejs_define_version nodejs-punycode 2.1.0
# Version from node-v24.18.0/deps/undici/src/package.json
%nodejs_define_version nodejs-undici 7.28.0
# Version from node-v24.18.0/deps/npm/package.json
%nodejs_define_version npm 1:11.16.0-%{nodejs_subpackage_release}
# Version from node-v24.18.0/deps/sqlite/sqlite3.h
%nodejs_define_version sqlite 3.53.1
# Version from node-v24.18.0/deps/uvwasi/include/uvwasi.h
# Version from node-v24.19.0/deps/undici/src/package.json
%nodejs_define_version nodejs-undici 7.29.0
# Version from node-v24.19.0/deps/npm/package.json
%nodejs_define_version npm 1:11.17.0-%{nodejs_subpackage_release}
# Version from node-v24.19.0/deps/sqlite/sqlite3.h
%nodejs_define_version sqlite 3.53.3
# Version from node-v24.19.0/deps/uvwasi/include/uvwasi.h
%nodejs_define_version uvwasi 0.0.23
# Version from node-v24.18.0/deps/v8/include/v8-version.h
# Version from node-v24.19.0/deps/v8/include/v8-version.h
%nodejs_define_version v8 3:13.6.233.17-%{nodejs_subpackage_release} -p
# Version from node-v24.18.0/deps/zlib/zlib.h
%nodejs_define_version zlib 1.3.1
# Version from node-v24.19.0/deps/zlib/zlib.h
%nodejs_define_version zlib 1.3.2.1-motley
# END automatic-version-macros # DO NOT REMOVE THIS LINE!
# === Conditional build – global options
@ -312,8 +312,6 @@ readonly -a configure_flags=(
%if %{without bundled_nodejs_undici}
--shared-builtin-undici/undici-path=%{nodejs_common_sitelib}/undici/loader.js
%endif
# Enable LTO where possible
--enable-lto
# Compile with small icu, extendable via full-i18n subpackage
--with-intl=small-icu --with-icu-default-data-dir=%{nodejs_datadir}/icudata
# Do not ship corepack

2
sources
View File

@ -1,4 +1,4 @@
SHA512 (node-v24.18.0-stripped.tar.gz) = 53eddd27f3c4e748f00ff74f1a5116ef14f27b26f6886dbe614a556c11abdef4c85927895e844956dbf782bfc5f57497e38e4110aef6d8673cc5a730d7a476bb
SHA512 (node-v24.19.0-stripped.tar.gz) = 9bf298927f789151276a0ba4325735ba1b0a8e8ce481abef3a04b049acd11ea542078ce40f1cda5bc628bed0ebb9adddba1e8600a9f686b649e9dacad321cbf7
SHA512 (icu4c-78.3-data-bin-b.zip) = 99e984f706423eccd14507c43d479a116a69ccbcf28af765d4dad7d6397eaa9be60208febf45efefc1932479c7b26d3246d2c08b20f99ad9b81512761726b5a4
SHA512 (icu4c-78.3-data-bin-l.zip) = 4f0f083fe62c35da76a150498e04230bc2dfba6c07f32781f5173c13c3e1237e4157fa312dabb69909f495b84334f1ef544244268efa667927b20350a1d3d455
SHA512 (packaging-scripts.tar.gz) = 09e566ddf0b9d613ec0714fc191f214473b36f636ebf08eaf333429bc4abac8dc9356fcc9292cf67e5900e327b1a21223ef552b27f0d01f92cf9fd8ed6edff36

1
test-should-pass.txt
View File

@ -7,7 +7,6 @@
# Each exception should be explained with a comment
# containing date and a short description of the problem
#
wasm-allocation/test-wasm-allocation.js
node-api/test_threadsafe_function/uncaught_exception.js
pummel/test-heapsnapshot-near-heap-limit-by-api.js
pummel/test-heapdump-fs-promise.js