Backport CVE-2026-59873 fix by upgrading the bundled node-tar
package (within npm) from 7.5.15 to 7.5.19. The patch extracts
only the 13 tar-related files from the upstream npm 11.18.0
upgrade commit. Key security fixes include a
maxDecompressionRatio guard in the tar parser, rejection of
negative size values in headers and PAX extensions, and
String() wrapping in normalize-windows-path. Conflicts with
the RHEL base (7.5.15 vs expected 7.5.16) were resolved
manually in header.js, index.min.js, and package.json.
CVE: CVE-2026-59873, CVE-2026-58874
Upstream patches:
- fd35018553.patch
Advisories:
https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5whttps://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
Resolves: RHEL-193835 RHEL-193868
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
The following CVEs were fixed in the NodeJS itself:
CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712
CVE-2026-21713 CVE-2026-21714 CVE-2026-21715 CVE-2026-21716
CVE-2026-21717
The following CVEs were fixed in bundled undici:
CVE-2026-1525 CVE-2026-1528 CVE-2026-2581 CVE-2026-1527 CVE-2026-2229
CVE-2026-1526
Resolves: RHEL-163752
In some environments, a variant of rpm parser is used that does not
expand Lua or shell invocations. In that environment, using
%nodejs_define_version for defining (parts of) Name:, Version:, or
Release: fields will result in them being empty or incomplete
This swaps the definition order around, so that the fields are set
first with the verbatim values.
Signed-off-by: Jan Staněk <jstanek@redhat.com>
Resolves: RHEL-111978
- Use correct form of %node_evr in place of non-existent %nodejs_evr
- Utilize %nodejs_subpackage_release during definition of the version
macros, then rely on %<name>_release everywhere.
[skip changelog]
Resolves: RHEL-111616
Extend existing shebang fixes to cover all npm nested modules and
shell scripts that call 'node' as a command. This prevents failures
when scripts try to call /usr/bin/node which is not shipped, instead
redirecting them to the versioned /usr/bin/node-24 binary.
Fixes include:
- All JavaScript/TypeScript files with node shebangs in npm nested modules
- Shell scripts like node-gyp that call 'node' as a command
- Remove tests that have issues with kojistream network
- Temporarily use vendor copies of dependencies
not up-to-date enough in the system
Related: RHEL-101566
Signed-off-by: Jan Staněk <jstanek@redhat.com>
