nodejs - Debian Package Tracker

general

source: nodejs (main)
version: 20.18.2+dfsg-4
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Jérémy Lal [DMD]
arch: all amd64 arm64 armel armhf i386 mips64el powerpc ppc64 ppc64el s390x
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 10.24.0~dfsg-1~deb10u1
o-o-sec: 10.24.0~dfsg-1~deb10u4
oldstable: 12.22.12~dfsg-1~deb11u4
old-sec: 12.22.12~dfsg-1~deb11u5
stable: 18.19.0+dfsg-6~deb12u2
stable-sec: 18.19.0+dfsg-6~deb12u1
testing: 20.18.2+dfsg-4
unstable: 20.18.2+dfsg-4
exp: 22.12.0+dfsg-3

versioned links

10.24.0~dfsg-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
10.24.0~dfsg-1~deb10u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.19.0+dfsg-6~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.19.0+dfsg-6~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.18.2+dfsg-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.18.3+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.12.0+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnode-dev (1 bugs: 0, 1, 0, 0)
libnode115
nodejs (17 bugs: 1, 15, 1, 0)
nodejs-doc

action needed

debian/patches: 2 patches with invalid metadata, 4 patches to forward upstream high

Among the 26 debian patches available in version 20.18.3+dfsg-1 of the package, we noticed the following issues:

2 patches with invalid metadata that ought to be fixed.
4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-02-11 08:30

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:05:18
Last run: 2025-02-11T06:35:49.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:04:37
Last run: 2025-01-10T21:31:31.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:03:42
Last run: 2025-02-10T08:45:22.000Z
Previous status: unknown

Created: 2024-09-07 Last update: 2025-02-11 08:03

5 security issues in bullseye high

There are 5 open security issues in bullseye.

2 important issues:

CVE-2025-23083: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

3 ignored issues:

CVE-2023-30581: The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
CVE-2023-32002: The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVE-2023-32006: The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Created: 2025-01-22 Last update: 2025-02-11 04:00

9 security issues in bookworm high

There are 9 open security issues in bookworm.

9 important issues:

CVE-2023-46809: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVE-2024-21892: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-22019: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
CVE-2024-22020: A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
CVE-2024-22025: A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVE-2025-23083: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

Created: 2024-02-16 Last update: 2025-02-11 04:00

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

3 ignored issues:

CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Created: 2024-04-03 Last update: 2024-06-29 13:15

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-02-11 08:00

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-04-04 Last update: 2025-02-11 03:00

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 6703e52c153a0b7ded6fa94ed672129a17b70059
Author: Jérémy Lal <kapouer@melix.org>
Date:   Tue Dec 31 12:54:08 2024 +0100

    Depends node-corepack

commit 2ce9455e9f9897f572171aa2f3e422af722c8f81
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Dec 27 12:07:04 2024 +0100

    mips64el/r6el: fix mips-arch-variant accepted by v8

commit 0ba3ce3eac294dc84652b2529fb4bdf5d8d5e818
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Dec 11 23:53:27 2024 +0100

    Release to experimental

commit 6f11911fa030cd63f45a40c9e5502535cc470c71
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Dec 11 23:52:51 2024 +0100

    Breaks/Replaces libnode115 with libnode127

Created: 2024-12-11 Last update: 2025-02-10 18:00

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2024-11-21 Last update: 2024-11-21 07:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.6.2).

Created: 2024-04-07 Last update: 2025-02-11 08:02

testing migrations

This package will soon be part of the auto-nodejs transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for nodejs (20.18.2+dfsg-4 to 20.18.3+dfsg-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ autopkgtest for node-babel7/7.20.15+ds1+~cs214.269.168-7: amd64: Regression or new test ♻ (reference ♻), arm64: Regression or new test ♻ (reference ♻), ppc64el: Regression or new test ♻ (reference ♻)
- ∙ ∙ autopkgtest for node-chokidar/3.6.0-2: amd64: Pass, arm64: Regression or new test ♻ (reference ♻), ppc64el: Pass
- ∙ ∙ autopkgtest for node-mqtt/4.3.7-4: amd64: Pass, arm64: Pass, ppc64el: Regression or new test ♻ (reference ♻)
- ∙ ∙ autopkgtest for nodejs/20.18.3+dfsg-1: amd64: Pass, arm64: Pass, ppc64el: Pass
- ∙ ∙ missing build on armel
- ∙ ∙ missing build on armhf
- ∙ ∙ missing build on i386
- ∙ ∙ missing build on mips64el
- ∙ ∙ missing build on riscv64
- ∙ ∙ missing build on s390x
- ∙ ∙ arch:armel not built yet, autopkgtest delayed there
- ∙ ∙ arch:armhf not built yet, autopkgtest delayed there
- ∙ ∙ arch:i386 not built yet, autopkgtest delayed there
- ∙ ∙ arch:riscv64 not built yet, autopkgtest delayed there
- ∙ ∙ arch:s390x not built yet, autopkgtest delayed there
- ∙ ∙ Too young, only 0 of 5 days old
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/n/nodejs.html
- ∙ ∙ Waiting for reproducibility test results on amd64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on arm64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
- ∙ ∙ Waiting for reproducibility test results on i386 - info ♻
- Not considered

news

[rss feed]

[2025-02-11] nodejs 20.18.2+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-02-11] Accepted nodejs 20.18.3+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-02] Accepted nodejs 20.18.2+dfsg-4 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-3 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-01-26] Accepted nodejs 20.18.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-01-11] nodejs 20.18.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-01-01] Accepted nodejs 20.18.1+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-3 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-2 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-11] Accepted nodejs 22.12.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2024-12-02] nodejs 20.18.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-11-20] Accepted nodejs 20.18.1+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-11-18] nodejs 20.18.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-11-08] Accepted nodejs 20.18.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-11-08] Accepted nodejs 20.18.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-09-14] Accepted nodejs 12.22.12~dfsg-1~deb11u5 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2024-09-01] nodejs 20.17.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-08-29] Accepted nodejs 20.17.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-08-28] Accepted nodejs 20.17.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-08-24] nodejs 20.16.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-08-18] Accepted nodejs 20.16.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-07-09] Accepted nodejs 20.15.1+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-07-07] nodejs 20.15.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-06-25] Accepted nodejs 20.15.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2024-06-24] nodejs 20.14.0+dfsg-3 MIGRATED to testing (Debian testing watch)
[2024-06-22] Accepted nodejs 18.19.0+dfsg-6~deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2024-06-21] Accepted nodejs 18.19.0+dfsg-6~deb12u1 (source amd64 all) into proposed-updates (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-06-19] Accepted nodejs 20.14.0+dfsg-3 (source) into unstable (Jérémy Lal)
[2024-06-12] Accepted nodejs 20.14.0+dfsg-2 (source) into unstable (Jérémy Lal)

bugs [bug history graph]

all: 26 27
RC: 2
I&N: 21 22
M&W: 1
F&P: 2
patch: 3

links

homepage
buildd: logs, exp, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20.18.1+dfsg-1ubuntu1
47 bugs (1 patch)
patches for 20.18.1+dfsg-1ubuntu1