rpms/nodejs24
9
0
Fork 0
Code Issues Pull requests Releases Activity
0 releases 22 tags
  • imports/c10s/nodejs24-24.19.0-1.el10 cafce37fa3

    Update to version 24.19.0

    Ghost released this 2026-08-31 14:40:42 +00:00 | 1 commits to c10s since this release

    CVE fixes included in rebase:
    CVE-2026-56846 - http2: retained headers can bypass maxSessionMemory limits,
    allowing remote memory exhaustion
    CVE-2026-56848 - http2: re-entrant send during nghttp2_session_mem_recv() can
    cause heap-use-after-free
    CVE-2026-58043 - permission: path matching can over-grant filesystem access
    across radix-tree prefix boundaries
    Blog: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

    Also following CVEs with lower severity:
    CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042,
    CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044

    Regenerate tar CVE patch (0001-CVE-2026-59873-CVE-2026-59874) against
    24.19.0 base, which ships tar 7.5.16 instead of 7.5.15.

    Disable LTO (--enable-lto) to fix segfault at startup caused by
    miscompilation with the new snapshot-in-libnode build changes in 24.19.0.

    Remove wasm-allocation test from test list: the test requires RLIMIT_AS
    set to 20GB to trigger OOM on WebAssembly.Memory allocations, which the
    RPM build environment does not enforce.

    Resolves: RHEL-234904 RHEL-234828 RHEL-234382

    Downloads