nodejs - Debian Package Tracker

general

source: nodejs (main)
version: 20.19.2+dfsg-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Jérémy Lal [DMD]
arch: all amd64 arm64 armel armhf i386 mips64el powerpc ppc64 ppc64el s390x
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 12.22.12~dfsg-1~deb11u4
old-sec: 12.22.12~dfsg-1~deb11u7
stable: 18.19.0+dfsg-6~deb12u2
stable-sec: 18.19.0+dfsg-6~deb12u1
testing: 20.19.2+dfsg-1
unstable: 20.19.2+dfsg-1
exp: 22.14.0+dfsg-1

versioned links

12.22.12~dfsg-1~deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.19.0+dfsg-6~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.19.0+dfsg-6~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.19.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.14.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnode-dev (1 bugs: 0, 1, 0, 0)
libnode115
nodejs (17 bugs: 1, 15, 1, 0)
nodejs-doc

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:03:59
Last run: 2025-08-02T14:30:52.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:03:46
Last run: 2025-08-01T19:11:30.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:03:09
Last run: 2025-07-28T08:28:49.000Z
Previous status: unknown

Created: 2024-09-07 Last update: 2025-08-08 14:30

A new upstream version is available: 20.19.4 high

A new upstream version 20.19.4 is available, you should consider packaging it.

Created: 2025-06-27 Last update: 2025-08-08 12:33

12 security issues in bookworm high

There are 12 open security issues in bookworm.

12 important issues:

CVE-2023-46809: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVE-2024-21892: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-22019: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
CVE-2024-22020: A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
CVE-2024-22025: A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVE-2025-23083: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVE-2025-23165: In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
CVE-2025-47153: Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.

Created: 2024-02-16 Last update: 2025-07-19 05:32

debian/patches: 1 patch with invalid metadata high

Among the 19 debian patches available in version 20.19.2+dfsg-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.

Created: 2023-02-26 Last update: 2025-05-18 21:00

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

3 ignored issues:

CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Created: 2024-04-03 Last update: 2024-06-29 13:15

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-04-04 Last update: 2025-08-08 14:03

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-08-08 14:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 22.18.0+dfsg-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 8ceeeb73ee569fa0a789912ed5f776fa7682ccc2
Merge: 3183f4c7 8f4fafda
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 10:09:25 2025 +0200

    Update upstream source from tag 'upstream/22.18.0+dfsg'
    
    Update to upstream version '22.18.0+dfsg'
    with Debian dir 48430a77441dfc14ac400d4eeb51bd95456404cb

commit 8f4fafda2ad1e9e4a63d2b57f893e0883a135bef
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 10:08:50 2025 +0200

    New upstream version 22.18.0+dfsg

commit 3183f4c783ee5dc3310bdb7aa84d33af1a76e74b
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 10:07:50 2025 +0200

    Build using shared zstd, and drop it from tarball

commit d19649366fc3699cfe4137065f8bf35dcbccc0a9
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 10:01:27 2025 +0200

    Update changelog

commit 29996f8507a3ed012539b353e07ae8242601c014
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 10:00:46 2025 +0200

    Refresh patches

commit af9c69428b30932865920651e530e58930c0c20e
Merge: d6dbd95c 0232fc38
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 09:45:13 2025 +0200

    Update upstream source from tag 'upstream/22.18.0+dfsg'
    
    Update to upstream version '22.18.0+dfsg'
    with Debian dir a1a760cdc70c54826a8ade4fe486c035144d0770

commit 0232fc388337fed49ba6ffb9a353e020f9df3a34
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 8 09:41:55 2025 +0200

    New upstream version 22.18.0+dfsg

commit d6dbd95c45e95a62ee2c00684c7900c24b02ca0c
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Jun 4 09:01:15 2025 +0200

    Fix builtins_module_paths_not_shareable.patch to include amaro

commit 7236b32fd4e7f0e134d1c22bca31faff9b9dfbfb
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Jun 4 08:45:18 2025 +0200

    Remove non-applied patch

commit 0f243772fff1d4c5e3e053453e665e2f40697f08
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Jun 2 01:38:21 2025 +0200

    Update changelog

commit 67e71bff8cb8e3fae9a872576779bbd1e7198a75
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Jun 2 01:32:53 2025 +0200

    Refresh patches

commit f6d3cc2c0f1a09899e8c0fa99c35ab0cb2377441
Merge: 8eb25f1f 6a57edfb
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Jun 2 01:26:46 2025 +0200

    Update upstream source from tag 'upstream/22.16.0+dfsg'
    
    Update to upstream version '22.16.0+dfsg'
    with Debian dir ce1e19a4d7042375b8120a2855ed188d883c383a

commit 6a57edfb59c6a83744d0ffceaec7eee4fac736c1
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Jun 2 01:26:09 2025 +0200

    New upstream version 22.16.0+dfsg

commit 8eb25f1fe3989348a131e9d5a549f24d76faa746
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Jun 2 01:24:30 2025 +0200

    Already absent tools/github_reporter/index.js

commit b2984c5bc9d01ec5d2768d2527fa540ae9350e46
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Mar 19 00:20:17 2025 +0100

    Update changelog

commit b81c18508f318e56e861febfeaf6f76d4ed4681d
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Mar 19 00:20:09 2025 +0100

    Recommends node-amaro

commit c37746c09aceeb981470a87b182eab6929b32ece
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Mar 19 00:11:37 2025 +0100

    patch to allow amaro as external builtin

commit 36aeadb8dc53a97bd99ec98d53abf31d3f5dddf1
Author: Jérémy Lal <kapouer@melix.org>
Date:   Tue Mar 18 13:18:42 2025 +0100

    Enable optional amaro

commit fe0df2b785ffb6e64f6c3586235040bf199b5691
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Mar 15 15:21:39 2025 +0100

    Release to experimental

commit f02948c386cc94d77fd918f71884b496661f5de9
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Mar 15 15:19:50 2025 +0100

    Skip tests using typescript support

commit 4b01ea58b5881cc6afdcf8b116e74937abd10f1d
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Mar 15 13:00:07 2025 +0100

    patch: use system builtins, fix another test

commit 72ae6c53afdb2c6d65a369996b18cf7099eeb7ed
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Mar 14 13:30:15 2025 +0100

    Fix patch

commit 96e238ace918b97032cf744c10440c8bf9d65901
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Mar 14 13:27:03 2025 +0100

    Fix builtins patch

commit 0c821d2574006b2e5be838f349e2049ff5cf2b72
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Mar 14 10:20:58 2025 +0100

    Update changelog

commit 45fb9e839530b51450f15f57884d3062711b9d85
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Mar 14 10:19:07 2025 +0100

    Refresh patches

commit 255ea9d12bd5f53ee8e72116e7adf6c914968e61
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 27 12:07:04 2024 +0100

    mips64el/r6el: fix mips-arch-variant accepted by v8

commit 803e75b2c89cf5e995fcf57861221b0941b040dd
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Dec 11 23:52:51 2024 +0100

    Breaks/Replaces libnode115 with libnode127

commit 444f95bf5286aff3d869fe1d99f8b745eac9065f
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Dec 11 14:18:20 2024 +0100

    ABI bump for packages

commit 7b71c58ad49e4a02fdefe111b42ba2d462a1072c
Author: Jérémy Lal <kapouer@melix.org>
Date:   Tue Dec 10 16:06:49 2024 +0100

    Depends libuv1-dev >= 1.48.0

commit c220885d59ea8b2cfa8bbdf175c42f837b039c52
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Dec 7 20:30:19 2024 +0100

    Require icu >= 73.1

commit 58f15da6acc98770b9b2f7f0ff5ed74777e5940b
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Dec 7 19:45:32 2024 +0100

    Add missing B-D sqlite3-dev

commit d0750dd30f43ec1bff1b99eee3fe941df4ce9fd7
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 6 15:54:03 2024 +0100

    Move to 22 branch

commit d726c2b5d3fb83bc48c86dcacd24908af381d93f
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 6 15:48:03 2024 +0100

    watch 22

commit bd9ddfb5328fbce4b7ada190e4d115f186a86665
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 6 15:47:50 2024 +0100

    Build without amaro, use shared sqlite

commit 18ac89fee144058a9edd0cdb6998cedabd47d893
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 6 15:47:42 2024 +0100

    dfsg-exclude sqlite, amaro

commit acd823a283628dc00b995bd94e9c21bc01db6c1e
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon May 19 22:06:08 2025 +0200

    Upstream supports HTTP QUERY and fix regression with llhttp

commit fc1e8ac1f2f0ee033f2d3509f239e322cb14ac45
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Mar 14 09:47:13 2025 +0100

    New upstream version 22.14.0+dfsg

Created: 2025-03-19 Last update: 2025-08-08 10:00

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-05-18 Last update: 2025-05-18 22:02

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2024-11-21 Last update: 2024-11-21 07:30

testing migrations

This package will soon be part of the auto-nodejs transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-06-04] nodejs 20.19.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-05-18] Accepted nodejs 20.19.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-05-11] nodejs 20.19.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-05-01] Accepted nodejs 12.22.12~dfsg-1~deb11u7 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-05-01] Accepted nodejs 20.19.0+dfsg1-1 (source) into unstable (Jérémy Lal)
[2025-04-09] nodejs 20.19.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-04-03] Accepted nodejs 20.19.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-03-24] nodejs 20.19.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-03-15] Accepted nodejs 22.14.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2025-03-14] Accepted nodejs 20.19.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-24] Accepted nodejs 12.22.12~dfsg-1~deb11u6 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-02-20] nodejs 20.18.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-11] nodejs 20.18.2+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-02-11] Accepted nodejs 20.18.3+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-02] Accepted nodejs 20.18.2+dfsg-4 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-3 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-01-26] Accepted nodejs 20.18.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-01-11] nodejs 20.18.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-01-01] Accepted nodejs 20.18.1+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-3 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-2 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-11] Accepted nodejs 22.12.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2024-12-02] nodejs 20.18.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-11-20] Accepted nodejs 20.18.1+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-11-18] nodejs 20.18.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-11-08] Accepted nodejs 20.18.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-11-08] Accepted nodejs 20.18.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-09-14] Accepted nodejs 12.22.12~dfsg-1~deb11u5 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2024-09-01] nodejs 20.17.0+dfsg-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 28 29
RC: 2
I&N: 23 24
M&W: 1
F&P: 2
patch: 3

links

homepage
lintian (0, 2)
buildd: logs, exp, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20.19.2+dfsg-1
48 bugs (1 patch)