rpms/nodejs24
7
0
Fork 0
Code Issues Pull Requests Releases Activity
23 Commits 2 Branches 16 Tags 376 KiB
c10s
Commit Graph

6 Commits

Author SHA1 Message Date
tjuhasz
dc3a5abd2a Update to version 24.18.0 
Resolves: RHEL-183886
Resolves: RHEL-189398
Resolves: RHEL-189348
Resolves: RHEL-185997
Resolves: RHEL-185984
Resolves: RHEL-185978
Resolves: RHEL-183655

CVE fixes included in rebase:
CVE-2026-48618 - tls: normalize hostname for server identity checks
CVE-2026-48933 - crypto: guard WebCrypto cipher output length
CVE-2026-6734 -  undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
 Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
CVE-2026-9697 -  undici vulnerable to TLS certificate validation bypass via
dropped requestTls in SOCKS5 ProxyAgent
  Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
CVE-2026-12151 - undici WebSocket client vulnerable to denial of service via fragment count bypass
 Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
CVE-2026-42338 - ip-address: Cross-site scripting via improper HTML escaping of untrusted input

Also following CVEs with lower severity:
CVE-2026-48615, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48934
CVE-2026-48937, CVE-2026-48617, CVE-2026-48931, CVE-2026-48935

Drop downstream nghttp2 patch
 2026-07-07 13:36:32 +02:00
Jan Staněk
8153e577a0
Update to version 24.14.1 
The following CVEs were fixed in the NodeJS itself:
CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712
CVE-2026-21713 CVE-2026-21714 CVE-2026-21715 CVE-2026-21716
CVE-2026-21717

The following CVEs were fixed in bundled undici:
CVE-2026-1525 CVE-2026-1528 CVE-2026-2581 CVE-2026-1527 CVE-2026-2229
CVE-2026-1526

Resolves: RHEL-163752
 2026-04-01 13:25:55 +02:00
Andrei Radchenko
cb29e3511f Update to 24.13.0 2026-01-16 10:22:48 +01:00
tjuhasz
b38bf4f73a Update to version 24.11.1 
Resolves: RHEL-114190
 2025-11-12 15:49:35 +01:00
tjuhasz
13e5baaf49 Update to version 24.6.0 
Include back patch to prevent usage of currently unsupported fips flags

Resolves: RHEL-109813 RHEL-109661
 2025-08-19 10:27:28 +02:00
Jan Staněk
6043c067e7
Import SRPM from Fedora Rawhide 
Related: RHEL-101566
 2025-07-22 14:36:42 +02:00