File _patchinfo of Package patchinfo.42347
<patchinfo incident="42347">
<issue tracker="bnc" id="1256848">VUL-0: CVE-2026-22036: nodejs16,nodejs18,nodejs22: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion</issue>
<issue tracker="bnc" id="1256569">VUL-0: CVE-2025-55130: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: file system permissions bypass via crafted symlinks</issue>
<issue tracker="bnc" id="1256574">VUL-0: CVE-2025-59466: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: uncatchable "Maximum call stack size exceeded" error when `async_hooks.createHook()` is enabled can lead to crash</issue>
<issue tracker="bnc" id="1256571">VUL-0: CVE-2025-55132: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: a file's access and modification timestamps can be changed via `futimes()` even when the process has only read permissions</issue>
<issue tracker="bnc" id="1256576">VUL-0: CVE-2026-21637: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service</issue>
<issue tracker="bnc" id="1256573">VUL-0: CVE-2025-59465: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error</issue>
<issue tracker="bnc" id="1256570">VUL-0: CVE-2025-55131: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs22,nodejs8: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets</issue>
<issue tracker="cve" id="2025-55132"/>
<issue tracker="cve" id="2026-22036"/>
<issue tracker="cve" id="2025-55131"/>
<issue tracker="cve" id="2025-55130"/>
<issue tracker="cve" id="2025-59465"/>
<issue tracker="cve" id="2026-21637"/>
<issue tracker="cve" id="2025-59466"/>
<packager>adamm</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for nodejs22</summary>
<description>This update for nodejs22 fixes the following issues:
Security fixes:
- CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading
to resource exhaustion (bsc#1256848)
- CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass
TLS error handling and causing denial of service (bsc#1256576)
- CVE-2025-55132: Fixed futimes() ability to acces file even if process has read
permissions only (bsc#1256571)
- CVE-2025-55131: Fixed race condition that allowed allocations with leftover data
leading to in-process secrets exposure (bsc#1256570)
- CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
- CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading
to crash (bsc#1256573)
- CVE-2025-59466: Fixed uncatchable "Maximum call stack size exceeded" error
leading to crash (bsc#1256574)
Other fixes:
- Update to 22.22.0:
* deps: updated undici to 6.23.0
* deps: updated bundled c-ares to 1.34.6 (if used)
* add TLSSocket default error handler
* disable futimes when permission model is enabled
* require full read and write to symlink APIs
* rethrow stack overflow exceptions in async_hooks
* refactor unsafe buffer creation to remove zero-fill toggle
* route callback exceptions through error handlers
- Update to 22.21.1:
* src: avoid unnecessary string -> char* -> string round trips
* src: remove unnecessary shadowed functions on Utf8Value & BufferValue
* process: fix hrtime fast call signatures
* http: improve writeEarlyHints by avoiding for-of loop
- Update to 22.21.0:
* cli: add --use-env-proxy
* http: support http proxy for fetch under NODE_USE_ENV_PROXY
* http: add shouldUpgradeCallback to let servers control HTTP upgrades
* http,https: add built-in proxy support in http/https.request and Agent
* src: add percentage support to --max-old-space-size
- Update to 22.20.0
* doc: stabilize --disable-sigusr1
* doc: mark path.matchesGlob as stable
* http: add Agent.agentKeepAliveTimeoutBuffer option
* http2: add support for raw header arrays in h2Stream.respond()
* inspector: add http2 tracking support
* sea: implement execArgvExtension
* sea: support execArgv in sea config
* stream: add brotli support to CompressionStream and DecompressionStream
* test_runner: support object property mocking
* worker: add cpu profile APIs for worker
- Update to 22.19.0
* cli: add NODE_USE_SYSTEM_CA=1
* cli: support ${pid} placeholder in --cpu-prof-name
* crypto: add tls.setDefaultCACertificates()
* dns: support max timeout
* doc: update the instruction on how to verify releases
* esm: unflag --experimental-wasm-modules
* http: add server.keepAliveTimeoutBuffer option
* lib: docs deprecate _http_*
* net: update net.blocklist to allow file save and file management
* process: add threadCpuUsage
* zlib: add dictionary support to zstdCompress and zstdDecompress
- Update to 22.18.0:
* deps: update amaro to 1.1.0
* doc: add all watch-mode related flags to node.1
* doc: add islandryu to collaborators
* esm: implement import.meta.main
* fs: allow correct handling of burst in fs-events with AsyncIterator
* permission: propagate permission model flags on spawn
* sqlite: add support for readBigInts option in db connection level
* src,permission: add support to permission.has(addon)
* url: add fileURLToPathBuffer API
* watch: add --watch-kill-signal flag
* worker: make Worker async disposable
</description>
</patchinfo>
