-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 08 Aug 2026 15:01:44 +0200
Source: nodejs
Architecture: source
Version: 24.19.0+dfsg+~cs24.13.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@alioth-lists.debian.net>
Changed-By: Jérémy Lal <kapouer@melix.org>
Changes:
nodejs (24.19.0+dfsg+~cs24.13.3-1) unstable; urgency=medium
.
* New upstream version 24.19.0+dfsg+~cs24.13.3
This release addresses the following vulnerabilities:
+ CVE-2026-58042: dns: handle large resolveAny address replies
+ CVE-2026-58044: http: reject requests exceeding max header count
+ CVE-2026-56848: http2: defer rst stream while in scope
+ CVE-2026-56846: http2: retain header memory in session accounting
+ CVE-2026-58040: https: bind identity checks to session reuse
+ CVE-2026-56850: https: distinguish PFX object-array agent keys
+ CVE-2026-58043: permission: avoid granting radix split nodes
+ CVE-2026-58039: permission: check final report output path
+ CVE-2026-56847: permission: enforce fs write permission for trace events
+ CVE-2026-58041: sqlite: invalidate tag store iterators on statement reset
+ CVE-2026-58045: zlib: throw on out-of-bounds write buffers
* Refresh doc generator, fix links
* Skip another typescript test
Checksums-Sha1:
88af0f3042d7711abd4b0a5e659955be865a4c0f 4587 nodejs_24.19.0+dfsg+~cs24.13.3-1.dsc
92bf0dfe4742f0a31baf8b69ae1bab944aa9d5fc 340304 nodejs_24.19.0+dfsg+~cs24.13.3.orig-types-node.tar.xz
e80fc5bf7f637d87eaf09115d4d592e7e028f4a9 23001816 nodejs_24.19.0+dfsg+~cs24.13.3.orig.tar.xz
25c7c6258c853ef5bc042660ab023a73b76e3869 166132 nodejs_24.19.0+dfsg+~cs24.13.3-1.debian.tar.xz
5b29f1c428997d8dd016c15c0542c2af6569c985 11664 nodejs_24.19.0+dfsg+~cs24.13.3-1_source.buildinfo
Checksums-Sha256:
5201939aa2767dfae3ff2a287493f103b71dbc3a2f1db9050aa5c60346394a72 4587 nodejs_24.19.0+dfsg+~cs24.13.3-1.dsc
f616b3b5dd6e877d36f07e4517e1d3cbca2240a0c55a3d73641da87c925b436d 340304 nodejs_24.19.0+dfsg+~cs24.13.3.orig-types-node.tar.xz
84af326439f469735a2fb5f3c82496317bc3f23cbbeeb49ae5fbf3d3a2065cd7 23001816 nodejs_24.19.0+dfsg+~cs24.13.3.orig.tar.xz
1924e06df59506d9e4c4d0ba483dbf272d06ad3e7ce63b575666ad5387acf795 166132 nodejs_24.19.0+dfsg+~cs24.13.3-1.debian.tar.xz
97e49e021e6ee966e1835657c6292961011019220667fdc9af1621a609457b3f 11664 nodejs_24.19.0+dfsg+~cs24.13.3-1_source.buildinfo
Files:
65325c427eeb8f142e863c7471258ea0 4587 javascript optional nodejs_24.19.0+dfsg+~cs24.13.3-1.dsc
e8ef65ea84bcdc7684a7ef2a9a19270b 340304 javascript optional nodejs_24.19.0+dfsg+~cs24.13.3.orig-types-node.tar.xz
82e652207db52a7061e38036daf4624b 23001816 javascript optional nodejs_24.19.0+dfsg+~cs24.13.3.orig.tar.xz
6311f411a07281d1fa243fcdb18f7afd 166132 javascript optional nodejs_24.19.0+dfsg+~cs24.13.3-1.debian.tar.xz
d24b8e64f8efc79c4e3d691940b31489 11664 javascript optional nodejs_24.19.0+dfsg+~cs24.13.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCAAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmp3UVkSHGthcG91ZXJA
bWVsaXgub3JnAAoJEGYRwF7dOfN0dvwP/RxVH2n3AI6HfWq9Q/lmdBjo210WS87c
4Xgav+H8f6LGjU3iubIfYWYno0H/vxfNopQOondnk6VVga6iu4/3WqShJa+arhjT
KGAFCZhY+OFiJYkyKcZE7Y6c1SakZIy28WCjf/fQMGE7DSlpoOQvasYK/SNAieLI
gk3sE03sV6FMRsgm6M5qgA32oBB3+omfdN9fEUxODlfxLvL8mTmwnUBRrdsdik8L
eTc+JxUkPvrdtr8Y6i3jcErKcRQ3w0VQCztvVqHpzd636vcy9remHAmbm1bJrt2a
G6kasGCVqA9cax72AhRaYf08Ikq02P3uTuc5YOn+a1sWkPq5JTc5NyrEBvlkrocJ
yWujlPhL4op0PtM46SVGDw2sAWZ0saRFcOwY6P0W4Oy5hJS/8NI+E8+Y5OdAbOiK
UkCjPY+YRnsTSdalJmNkPEHhyWWduApEdsge+rU7shEDmeDIx2MCyehrGboLVFW6
6pBuba/fNDkqjqKmXhMQDzb61TqoLGLwopm7iiOuVl9Y3b40aHz4JnJtsMMJ+Fb/
t7qgkLMsduVoTv59Bu6DNEwQBCcHf2V0PeeXyUTsf8k/jWS2bDZV0ikgJGweRP9m
PqkqVRoXKdyCe+22edkou7AhZHBdt+MBixBRMI/tWNqzuY5rYh4zjYHFsXeY34uG
ejla0+azdgmj
=n2oQ
-----END PGP SIGNATURE-----
