-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 27 Oct 2026 01:28:41 +0100
Source: nodejs
Architecture: source
Version: 24.22.1+dfsg+~cs24.19.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@alioth-lists.debian.net>
Changed-By: Jérémy Lal <kapouer@melix.org>
Changes:
nodejs (24.22.1+dfsg+~cs24.19.2-1) unstable; urgency=medium
.
* New upstream version 24.22.1+dfsg+~cs24.19.2.
+ CVE-2026-105481 http: ensure agent data guard works without I/O
+ CVE-2026-105482 dns: validate resolve inputs for null bytes
+ CVE-2026-105483 tls: fix ip normalization regression
+ CVE-2026-106069 tls: reject non-canonical IP addresses
+ CVE-2026-106072 tls: fix certificate validation for non-canonical IPv4 hostnames
Upstream forgot to list it in changelog, see
https://github.com/nodejs/node/pull/66984
+ CVE-2026-106073 permission: check permission model in realpathSync
+ CVE-2026-106074 crypto: reset random caches across snapshots
+ CVE-2026-111497 src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH`
* B-D brotli 1.2.0-4.1 because of CVE-2026-111497 change.
Checksums-Sha1:
7677fc4b51d5e6154a5b459355ee0768000435c7 4566 nodejs_24.22.1+dfsg+~cs24.19.2-1.dsc
1a424c8ff105c6d0aa093f26d429345e0db5c7f8 349764 nodejs_24.22.1+dfsg+~cs24.19.2.orig-types-node.tar.xz
5f012e5a3e48bccd7b4b44fa2517534b6f847fb3 24123796 nodejs_24.22.1+dfsg+~cs24.19.2.orig.tar.xz
a4e0a27d50b7a0af46c7bc2d79cc3a60a0705294 166888 nodejs_24.22.1+dfsg+~cs24.19.2-1.debian.tar.xz
848c5de51ffe2ed804bd87992f54807ad620cae9 11991 nodejs_24.22.1+dfsg+~cs24.19.2-1_source.buildinfo
Checksums-Sha256:
a88f0e64088d6f3b0771b26fa06da73600c7fc52a36e26237deab1381e2d0200 4566 nodejs_24.22.1+dfsg+~cs24.19.2-1.dsc
910d827a0f8bffdd516875a76572eb53c9616dcbd458e61fa26d00f65d4bd5db 349764 nodejs_24.22.1+dfsg+~cs24.19.2.orig-types-node.tar.xz
c8769927c19311f07fb5242e8d82f6a98d81dd72f67b4040b465afd4154beb31 24123796 nodejs_24.22.1+dfsg+~cs24.19.2.orig.tar.xz
2e6223b81269e3704a0bbf072fe522fe25f25392a7afae7237de7b5bf9a171de 166888 nodejs_24.22.1+dfsg+~cs24.19.2-1.debian.tar.xz
d478d7144cf25e065edd5f3857e2f7dde68689acecef8397eec6f7b31f293241 11991 nodejs_24.22.1+dfsg+~cs24.19.2-1_source.buildinfo
Files:
1aaaaf877a0a140235481286350dedc9 4566 javascript optional nodejs_24.22.1+dfsg+~cs24.19.2-1.dsc
1de80f97a87b51f555f40a56a60025d4 349764 javascript optional nodejs_24.22.1+dfsg+~cs24.19.2.orig-types-node.tar.xz
ac1e070a03c970682f02e9f0d533e87f 24123796 javascript optional nodejs_24.22.1+dfsg+~cs24.19.2.orig.tar.xz
fcb180e5623e6fee99b990d46bdf454c 166888 javascript optional nodejs_24.22.1+dfsg+~cs24.19.2-1.debian.tar.xz
9a462c9952360c5b5ff2f97346f53c3d 11991 javascript optional nodejs_24.22.1+dfsg+~cs24.19.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCAAtFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmrf8IoPHGplcnJ5QGVk
YS5zYXJsAAoJEGYRwF7dOfN0NMUP/RA36c5mVGHIBoSfMmidQUgtX/m8jKbdw8aZ
FXKZYZthVsTkkjCBjvQxm0ZheFnUfSZ54S4fjaRALM+5YjBnzIpDd3/p63KHqDBp
qMM8qnvemd7O0X9Eyljh85T3xRCKUxV8k2HgzFGH+yIrjHwOVLw2zM2elzVs7Lij
Sq7Lvd+v4c4uBiA2SZzaXhrhRgiqGqsZ2k8Z3Fu1eGQ+rAZJHCtDnybjQZBW4nMi
NaPKovBOvTB4oOBORBOrkk7CebcB44VqJqo/VhwtF5iqPX549cNNke8HR8mhDMrI
DWvv2YlKIJCd4cDb0fpZ3dOJIUD6H9vuuLtm7P8PAIj0zpPU6WvsYQbopc81t+oA
/4GepFNe0FmavdhW+oyu1yivCINLsbOcMD3ydR3QcmgKp/6oyHwfO74DjoP28zaz
BSLL5nlmRLxMER0xqTjJDzUzc7hpn6dTXAsvLYO+vfHv/BrJCwi1AtlOOXEmKHtX
FPisbLep6NWQUqGK2F96JKwlGYQWwX189BQeaJz8g0sRxl1mf+CVTCTlvMncogfi
+kOK3YoYFI72D5IayFDzyjyIA3QXdk6WwdSEdWtHGzn3nR35e/35cK/WiIOaV/8n
r0XrM9l3lM8DrVlGyF2ieq5LOda8fS5ruFa3U4t4aFNk2R0okUa3I59FYRB+wsVO
bD35E1x/
=yCWQ
-----END PGP SIGNATURE-----
