nodejs - Debian Package Tracker

general

source: nodejs (main)
version: 20.19.5+dfsg+~cs20.19.12-4
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Jérémy Lal [DMD]
arch: all amd64 arm64 armel armhf i386 mips64el powerpc ppc64 ppc64el s390x
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 12.22.12~dfsg-1~deb11u4
o-o-sec: 12.22.12~dfsg-1~deb11u7
oldstable: 18.20.4+dfsg-1~deb12u1
old-sec: 18.20.4+dfsg-1~deb12u1
stable: 20.19.2+dfsg-1
testing: 20.19.5+dfsg+~cs20.19.12-4
unstable: 20.19.5+dfsg+~cs20.19.12-4
exp: 22.19.0+dfsg+~cs22.18.0-1

versioned links

12.22.12~dfsg-1~deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.20.4+dfsg-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.19.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.19.5+dfsg+~cs20.19.12-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.14.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.18.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.18.0+dfsg+~cs22.17.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.19.0+dfsg+~cs22.18.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnode-dev (1 bugs: 0, 1, 0, 0)
libnode115
nodejs (17 bugs: 0, 16, 1, 0)
nodejs-doc

action needed

A new upstream version is available: 20.19.5+~cs20.19.23 high

A new upstream version 20.19.5+~cs20.19.23 is available, you should consider packaging it.

Created: 2025-09-06 Last update: 2025-10-28 12:30

debian/patches: 1 patch with invalid metadata, 1 patch to forward upstream high

Among the 20 debian patches available in version 20.19.5+dfsg+~cs20.19.12-4 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-10-08 23:04

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

3 ignored issues:

CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Created: 2024-04-03 Last update: 2024-06-29 13:15

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-10-28 14:30

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-04-04 Last update: 2025-10-28 11:33

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 22.20.0+dfsg+~cs22.18.8-1, distribution experimental) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 060eba63672b87fb7c43d56b6627e8b34cdc0435
Author: Alexandre Detiste <alexandre.detiste@gmail.com>
Date:   Sun Oct 19 01:19:14 2025 +0200

    drop obsolete dependency on dh-buildinfo

commit 4a84199843b192445cd903a0546f8ec9457f5044
Merge: d9f7592d a0605d30
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 15 19:22:39 2025 +0200

    Update upstream source from tag 'upstream/22.20.0+dfsg+_cs22.18.10'
    
    Update to upstream version '22.20.0+dfsg+~cs22.18.10'
    with Debian dir 91031174b55b6368e67ee7758b748480854541dd

commit a0605d30aa21b0900d5f91d2b0e623235158f6f5
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 15 19:21:47 2025 +0200

    New upstream version 22.20.0+dfsg+~cs22.18.10

commit d9f7592dc7b75106cdacdf60739f986213eab332
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 15 19:17:29 2025 +0200

    Fix amaro placeholder and postinst

commit 9ad681bfeac50e74d301940c41c2b07088db6e23
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 15 14:46:11 2025 +0200

    Update changelog

commit acd148916cf736306f5df63f9c077b65cbad97c9
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 8 19:23:13 2025 +0200

    loongson: sequential/test-cpu-prof-worker-argv is flaky

commit 01e4e24fc715bf7d679238ede11c736d4a0cd514
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 8 10:24:53 2025 +0200

    tests: mark more tests as flaky. Closes: #1117570.

commit 31115543357cf6a79056a32af565e37ce98b98c1
Author: Jérémy Lal <kapouer@melix.org>
Date:   Tue Oct 7 00:01:54 2025 +0200

    Mark test-cpu-prof-exit as flaky (fails on other archs).

commit f235fa4f0b3ca3f131b3421b65a8f2efbf96ae7b
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Oct 6 21:32:11 2025 +0200

    Fix evaluation of test exit code

commit 280c98628b8fc0c2b533240f3bb72f83d0897f26
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Oct 6 19:02:35 2025 +0200

    Move NODE_TEST_DIR to tmp dir

commit cbb9004b675c3a026653b26753717471ed02759a
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Sep 24 11:29:14 2025 +0200

    Just skip that remaining failing test

commit f36e43789b4a97f9414ef06663b499a6aec07b28
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Oct 15 14:43:29 2025 +0200

    amaro placeholder alternative

commit 864f52868b16638422f558e86b95fe97f6f1aa30
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Oct 13 19:59:37 2025 +0200

    Fix Breaks spacing and version

commit 0c1921a0bd250c5d4c4c40ff189baddddcac7415
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Oct 6 10:32:06 2025 +0200

    Insert old changelogs

commit 8ab16e2904e972355666b2dd613395478199ebef
Author: Jérémy Lal <kapouer@melix.org>
Date:   Mon Oct 6 09:02:16 2025 +0200

    Refresh patches

commit 066601809a8aa7670740059c82bfb21943381514
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Oct 5 18:28:01 2025 +0200

    check target: need out directory

commit b7f654cfbaae8d17aee3481b514d9122a3dead77
Merge: 4b8d2561 1a2ef5c1
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Oct 5 13:26:29 2025 +0200

    Update upstream source from tag 'upstream/22.20.0+dfsg+_cs22.18.8'
    
    Update to upstream version '22.20.0+dfsg+~cs22.18.8'
    with Debian dir 10af68364fb197ae4bd3e65932d3e96629b6e56e

commit 1a2ef5c1ca7e8e68702d2e1057bfe299ac77b27b
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Oct 5 13:25:56 2025 +0200

    New upstream version 22.20.0+dfsg+~cs22.18.8

commit 4b8d2561664f1663dcc4b1ac4ff2a4ca5422667e
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Oct 4 22:47:46 2025 +0200

    Try to not copy everything

commit 534c14c477811f6f911069ba2c7653002e219a7d
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Oct 4 17:36:30 2025 +0200

    Better cleanup

commit 3f1834ae16ac98f6b4b37baf3c2c012b3533a7be
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sat Oct 4 17:33:32 2025 +0200

    rules: copy in a safe dir name to run tests

commit c709da2830107516efa4ae1d1be7a716544e3a14
Author: Jérémy Lal <kapouer@melix.org>
Date:   Thu Sep 4 11:16:03 2025 +0200

    Breaks node-proxy agents << 0~2025070717~

commit 70bf86f75fe61f9396c8a22a8d9f410cc875af68
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Oct 5 13:22:48 2025 +0200

    Switch to watch 5 format

commit 03e7190b12e36008928919e5f4e9c92be28a912e
Author: Jérémy Lal <kapouer@melix.org>
Date:   Sun Aug 31 15:27:21 2025 +0200

    patch: upstream fix --shared-http-parser llhttp

commit 790166539021ed6e24011f5aff7944b7a1379fbb
Author: Jérémy Lal <kapouer@melix.org>
Date:   Wed Sep 3 20:21:33 2025 +0200

    Remove b-d libhttp-parser-dev

commit 95d586dc17e5fdd29474f3a7a14fad2964235176
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 22:43:39 2025 +0200

    B-D simdjson >= 3.13.0

commit 436ea2b6acdc2e16d86af58603fd2e7b66b53339
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 18:17:20 2025 +0200

    Build with libllhttp-dev

commit 617c75751cf0cf2c77729ced4a619821b7633ec6
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 16:53:10 2025 +0200

    Remove deps/llhttp from copyright

commit 46b0b3f15340e9f9dc8a0894198775a9cc929ecf
Author: Jérémy Lal <kapouer@melix.org>
Date:   Fri Aug 29 16:39:10 2025 +0200

    Exclude llhttp

Created: 2025-08-31 Last update: 2025-10-27 01:31

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-10-08 Last update: 2025-10-08 23:02

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-23085: (postponed; to be fixed through a stable update) A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVE-2025-23166: (postponed; to be fixed through a stable update) The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-02-16 Last update: 2025-10-25 22:00

testing migrations

This package will soon be part of the auto-nodejs transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-10-13] nodejs 20.19.5+dfsg+~cs20.19.12-4 MIGRATED to testing (Debian testing watch)
[2025-10-08] Accepted nodejs 20.19.5+dfsg+~cs20.19.12-4 (source) into unstable (Jérémy Lal)
[2025-10-06] Accepted nodejs 20.19.5+dfsg+~cs20.19.12-3 (source) into unstable (Jérémy Lal)
[2025-10-06] Accepted nodejs 20.19.5+dfsg+~cs20.19.12-2 (source) into unstable (Jérémy Lal)
[2025-10-05] Accepted nodejs 20.19.5+dfsg+~cs20.19.12-1 (source) into unstable (Jérémy Lal)
[2025-09-25] nodejs 20.19.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-29] Accepted nodejs 18.20.4+dfsg-1~deb12u1 (source amd64 all) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Jérémy Lal)
[2025-08-29] Accepted nodejs 18.20.4+dfsg-1~deb12u1 (source amd64 all) into oldstable-security (Debian FTP Masters) (signed by: Jérémy Lal)
[2025-08-29] Accepted nodejs 22.19.0+dfsg+~cs22.18.0-1 (source) into experimental (Jérémy Lal)
[2025-08-22] Accepted nodejs 22.18.0+dfsg+~cs22.17.2-2 (source) into experimental (Jérémy Lal)
[2025-08-22] Accepted nodejs 22.18.0+dfsg+~cs22.17.2-1 (source) into experimental (Jérémy Lal)
[2025-08-21] Accepted nodejs 20.19.4+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-08-16] Accepted nodejs 22.18.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2025-06-04] nodejs 20.19.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-05-18] Accepted nodejs 20.19.2+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-05-11] nodejs 20.19.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-05-01] Accepted nodejs 12.22.12~dfsg-1~deb11u7 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-05-01] Accepted nodejs 20.19.0+dfsg1-1 (source) into unstable (Jérémy Lal)
[2025-04-09] nodejs 20.19.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-04-03] Accepted nodejs 20.19.0+dfsg-2 (source) into unstable (Jérémy Lal)
[2025-03-24] nodejs 20.19.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-03-15] Accepted nodejs 22.14.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2025-03-14] Accepted nodejs 20.19.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-24] Accepted nodejs 12.22.12~dfsg-1~deb11u6 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-02-20] nodejs 20.18.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-11] nodejs 20.18.2+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-02-11] Accepted nodejs 20.18.3+dfsg-1 (source) into unstable (Jérémy Lal)
[2025-02-02] Accepted nodejs 20.18.2+dfsg-4 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-3 (source) into unstable (Jérémy Lal)
[2025-02-01] Accepted nodejs 20.18.2+dfsg-2 (source) into unstable (Jérémy Lal)

bugs [bug history graph]

all: 27 28
RC: 1
I&N: 23 24
M&W: 1
F&P: 2
patch: 3

links

homepage
lintian (0, 3)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20.19.4+dfsg-1
48 bugs (1 patch)