nodejs - Debian Package Tracker

general

source: nodejs (main)
version: 20.19.4+dfsg-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Jérémy Lal [DMD]
arch: all amd64 arm64 armel armhf i386 mips64el powerpc ppc64 ppc64el s390x
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 12.22.12~dfsg-1~deb11u4
o-o-sec: 12.22.12~dfsg-1~deb11u7
oldstable: 18.19.0+dfsg-6~deb12u2
old-sec: 18.20.4+dfsg-1~deb12u1
stable: 20.19.2+dfsg-1
testing: 20.19.2+dfsg-1
unstable: 20.19.4+dfsg-1
exp: 22.19.0+dfsg+~cs22.18.0-1

versioned links

12.22.12~dfsg-1~deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.19.0+dfsg-6~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.20.4+dfsg-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.19.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.19.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.14.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.18.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.18.0+dfsg+~cs22.17.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.19.0+dfsg+~cs22.18.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnode-dev (1 bugs: 0, 1, 0, 0)
libnode115
nodejs (17 bugs: 0, 16, 1, 0)
nodejs-doc

action needed

A new upstream version is available: 20.19.5 high

A new upstream version 20.19.5 is available, you should consider packaging it.

Created: 2025-09-06 Last update: 2025-09-18 01:32

debian/patches: 1 patch with invalid metadata high

Among the 18 debian patches available in version 20.19.4+dfsg-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.

Created: 2023-02-26 Last update: 2025-08-21 23:04

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

3 ignored issues:

CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Created: 2024-04-03 Last update: 2024-06-29 13:15

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-04-04 Last update: 2025-09-18 07:02

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2025-08-26 Last update: 2025-09-18 06:02

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-09-18 06:01

6 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 03e7190b12e36008928919e5f4e9c92be28a912e
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Aug 31 15:27:21 2025 +0200

    patch: upstream fix --shared-http-parser llhttp

commit 790166539021ed6e24011f5aff7944b7a1379fbb
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Sep 3 20:21:33 2025 +0200

    Remove b-d libhttp-parser-dev

commit 95d586dc17e5fdd29474f3a7a14fad2964235176
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 22:43:39 2025 +0200

    B-D simdjson >= 3.13.0

commit 436ea2b6acdc2e16d86af58603fd2e7b66b53339
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 18:17:20 2025 +0200

    Build with libllhttp-dev

commit 617c75751cf0cf2c77729ced4a619821b7633ec6
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 16:53:10 2025 +0200

    Remove deps/llhttp from copyright

commit 46b0b3f15340e9f9dc8a0894198775a9cc929ecf
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 16:39:10 2025 +0200

    Exclude llhttp

https://salsa.debian.org/api/v4/projects/js-team%2Fnodejs API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 408.

Created: 2025-08-31 Last update: 2025-09-15 21:06

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-08-22 Last update: 2025-08-27 05:01

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-23085: (postponed; to be fixed through a stable update) A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVE-2025-23166: (postponed; to be fixed through a stable update) The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-02-16 Last update: 2025-09-06 12:03

testing migrations

This package will soon be part of the auto-nodejs transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for nodejs (20.19.2+dfsg-1 to 20.19.4+dfsg-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ autopkgtest for node-proxy-agents/0~2024040606-6: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), riscv64: Failed (not a regression) ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ autopkgtest for nodejs/20.19.4+dfsg-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- Additional info:
- ∙ ∙ Updating nodejs will fix bugs in testing: #1097473, #1106428
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/n/nodejs.html
- ∙ ∙ 28 days old (needed 5 days)
- Not considered

news

[rss feed]

[2025-08-29] Accepted nodejs 18.20.4+dfsg-1~deb12u1 (source amd64 all) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Jérémy Lal)
[2025-08-29] Accepted nodejs 18.20.4+dfsg-1~deb12u1 (source amd64 all) into oldstable-security (Debian FTP Masters) (signed by: Jérémy Lal)
[2025-08-29] Accepted nodejs 22.19.0+dfsg+~cs22.18.0-1 (source) into experimental (Jérémy Lal)
[2025-08-22] Accepted nodejs 22.18.0+dfsg+~cs22.17.2-2 (source) into experimental (Jérémy Lal)
[2025-08-22] Accepted nodejs 22.18.0+dfsg+~cs22.17.2-1 (source) into experimental (Jérémy Lal)
[2025-08-21] Accepted nodejs 20.19.4+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-08-16] Accepted nodejs 22.18.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2025-06-04] nodejs 20.19.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-05-18] Accepted nodejs 20.19.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-05-11] nodejs 20.19.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-05-01] Accepted nodejs 12.22.12~dfsg-1~deb11u7 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-05-01] Accepted nodejs 20.19.0+dfsg1-1 (source) into unstable (Jérémy Lal)
[2025-04-09] nodejs 20.19.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-04-03] Accepted nodejs 20.19.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-03-24] nodejs 20.19.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-03-15] Accepted nodejs 22.14.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2025-03-14] Accepted nodejs 20.19.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-24] Accepted nodejs 12.22.12~dfsg-1~deb11u6 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-02-20] nodejs 20.18.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-11] nodejs 20.18.2+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-02-11] Accepted nodejs 20.18.3+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-02] Accepted nodejs 20.18.2+dfsg-4 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-3 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-01-26] Accepted nodejs 20.18.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-01-11] nodejs 20.18.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-01-01] Accepted nodejs 20.18.1+dfsg-2 (source) into unstable (Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-3 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-12] Accepted nodejs 22.12.0+dfsg-2 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2024-12-11] Accepted nodejs 22.12.0+dfsg-1 (source) into experimental (Jérémy Lal)

bugs [bug history graph]

all: 27 28
RC: 1
I&N: 23 24
M&W: 1
F&P: 2
patch: 3

links

homepage
lintian (0, 3)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20.19.4+dfsg-1
48 bugs (1 patch)