CVE fixes included in rebase:
CVE-2026-56846 - http2: retained headers can bypass maxSessionMemory limits,
allowing remote memory exhaustion
CVE-2026-56848 - http2: re-entrant send during nghttp2_session_mem_recv() can
cause heap-use-after-free
CVE-2026-58043 - permission: path matching can over-grant filesystem access
across radix-tree prefix boundaries
Blog: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
Also following CVEs with lower severity:
CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042,
CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044
Regenerate tar CVE patch (0001-CVE-2026-59873-CVE-2026-59874) against
24.19.0 base, which ships tar 7.5.16 instead of 7.5.15.
Disable LTO (--enable-lto) to fix segfault at startup caused by
miscompilation with the new snapshot-in-libnode build changes in 24.19.0.
Remove wasm-allocation test from test list: the test requires RLIMIT_AS
set to 20GB to trigger OOM on WebAssembly.Memory allocations, which the
RPM build environment does not enforce.
Resolves: RHEL-234904 RHEL-234828 RHEL-234382
cafce37fa3