rpms/nodejs24
7
0
Fork 0
Code Issues Pull Requests Releases Activity
28 Commits 2 Branches 21 Tags 776 KiB
c10s
Commit Graph

7 Commits

Author SHA1 Message Date
tjuhasz
cafce37fa3 Update to version 24.19.0 
CVE fixes included in rebase:
CVE-2026-56846 - http2: retained headers can bypass maxSessionMemory limits,
 allowing remote memory exhaustion
CVE-2026-56848 - http2: re-entrant send during nghttp2_session_mem_recv() can
 cause heap-use-after-free
CVE-2026-58043 - permission: path matching can over-grant filesystem access
 across radix-tree prefix boundaries
 Blog: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Also following CVEs with lower severity:
CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042,
CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044

Regenerate tar CVE patch (0001-CVE-2026-59873-CVE-2026-59874) against
24.19.0 base, which ships tar 7.5.16 instead of 7.5.15.

Disable LTO (--enable-lto) to fix segfault at startup caused by
miscompilation with the new snapshot-in-libnode build changes in 24.19.0.

Remove wasm-allocation test from test list: the test requires RLIMIT_AS
set to 20GB to trigger OOM on WebAssembly.Memory allocations, which the
RPM build environment does not enforce.

Resolves: RHEL-234904 RHEL-234828 RHEL-234382
 2026-08-31 16:40:42 +02:00
tjuhasz
dc3a5abd2a Update to version 24.18.0 
Resolves: RHEL-183886
Resolves: RHEL-189398
Resolves: RHEL-189348
Resolves: RHEL-185997
Resolves: RHEL-185984
Resolves: RHEL-185978
Resolves: RHEL-183655

CVE fixes included in rebase:
CVE-2026-48618 - tls: normalize hostname for server identity checks
CVE-2026-48933 - crypto: guard WebCrypto cipher output length
CVE-2026-6734 -  undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
 Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
CVE-2026-9697 -  undici vulnerable to TLS certificate validation bypass via
dropped requestTls in SOCKS5 ProxyAgent
  Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
CVE-2026-12151 - undici WebSocket client vulnerable to denial of service via fragment count bypass
 Advisory: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
CVE-2026-42338 - ip-address: Cross-site scripting via improper HTML escaping of untrusted input

Also following CVEs with lower severity:
CVE-2026-48615, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48934
CVE-2026-48937, CVE-2026-48617, CVE-2026-48931, CVE-2026-48935

Drop downstream nghttp2 patch
 2026-07-07 13:36:32 +02:00
Jan Staněk
8153e577a0
Update to version 24.14.1 
The following CVEs were fixed in the NodeJS itself:
CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712
CVE-2026-21713 CVE-2026-21714 CVE-2026-21715 CVE-2026-21716
CVE-2026-21717

The following CVEs were fixed in bundled undici:
CVE-2026-1525 CVE-2026-1528 CVE-2026-2581 CVE-2026-1527 CVE-2026-2229
CVE-2026-1526

Resolves: RHEL-163752
 2026-04-01 13:25:55 +02:00
Andrei Radchenko
cb29e3511f Update to 24.13.0 2026-01-16 10:22:48 +01:00
tjuhasz
b38bf4f73a Update to version 24.11.1 
Resolves: RHEL-114190
 2025-11-12 15:49:35 +01:00
tjuhasz
13e5baaf49 Update to version 24.6.0 
Include back patch to prevent usage of currently unsupported fips flags

Resolves: RHEL-109813 RHEL-109661
 2025-08-19 10:27:28 +02:00
Jan Staněk
6043c067e7
Import SRPM from Fedora Rawhide 
Related: RHEL-101566
 2025-07-22 14:36:42 +02:00