Debian Patches

Status for nodejs/20.19.2+dfsg-1+deb13u3

Patch Description Author Forwarded Bugs Origin Last update
sec/CVE-2026-56846.patch http2: retain header memory in session accounting Matteo Collina <hello@matteocollina.com> yes upstream https://github.com/nodejs/node/commit/f14d78b9e0201bfe0291f2b0dc4b5d88c70cc28e 2026-06-08
sec/CVE-2026-56847.patch permission: enforce fs write permission for trace events RafaelGSS <rafael.nunu@hotmail.com> yes upstream https://github.com/nodejs/node/commit/0566c3cccdc99b935646e813f71e2380aedee50d 2026-07-03
sec/CVE-2026-56848.patch http2: defer rst stream while in scope Matteo Collina <hello@matteocollina.com> yes upstream https://github.com/nodejs/node/commit/daa6d25e3dceb30edb832a778ec0610c8bc2dd12 2026-07-01
sec/CVE-2026-56850.patch https: distinguish PFX object-array agent keys RafaelGSS <rafael.nunu@hotmail.com> yes upstream https://github.com/nodejs/node/commit/acaf4266b2be7958e3d7cb44b5ee1c2b96eca278 2026-07-20
sec/CVE-2026-58039.patch permission: check final report output path RafaelGSS <rafael.nunu@hotmail.com> yes upstream backport, https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20 2026-06-26
sec/CVE-2026-58042.patch dns: handle large resolveAny address replies RafaelGSS <rafael.nunu@hotmail.com> no 2026-07-19
sec/CVE-2026-58043.patch permission: avoid granting radix split nodes RafaelGSS <rafael.nunu@hotmail.com> yes upstream https://github.com/nodejs/node/commit/440329f6247c8abb4c7cb4217e5a546ad41cd5ed 2026-06-30
sec/CVE-2026-58040.patch https: bind identity checks to session reuse Matteo Collina <hello@matteocollina.com> no backport, https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62 2026-06-23
sec/17-fix-possible-dereference-of-null-pointer.patch src: fix possible dereference of null pointer
There is a CHECK_NOT_NULL check before dereferencing node_env on
line 710 in the "if" block, but there is no CHECK_NOT_NULL check before
dereferencing node_env on line 721. Maybe it makes sense to put
CHECK_NOT_NULL right after calling the Environment::GetCurrent function.		 Eusgor <100363036+Eusgor@users.noreply.github.com> no 2025-05-30
sec/19-v8-fix-missing-callback-in-heap-utils-destroy.patch v8: fix missing callback in heap utils destroy
This fixes the v8.getHeapSnapshot() calls not properly being
destroyed. Pipeline calls would for example not properly end
without the callback being in place.		 Ruben Bridgewater <ruben.bridgewater@datadoghq.com> no 2025-06-30
sec/27-v8-loong64-avoid-memory-access-under-stack-pointer.patch deps: V8: cherry-pick 6b1b9bca2a8
Origin commit message:

[loong64][codegen] Avoid memory access under stack pointer

According to LoongArch ABI doc chapter 8.2:
"Procedures must not assume the persistence on-stack data of which
the addresses lie below the stack pointer."

Change-Id: I92735e052227495ac9884c4290b57eaffbf905e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786372
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#101634}		 zhoumingtao <zhoumingtao@loongson.cn> no 2025-07-30
sec/28-http2-do-not-crash-on-mismatched-ping-buffer-length.patch http2: do not crash on mismatched ping buffer length René <contact.9a5d6388@renegade334.me.uk> no 2025-10-09
sec/29-fix-order-of-check-not-null.patch src: fix order of CHECK_NOT_NULL/dereference
`ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS` may dereference
`req_wrap_async`, so `CHECK_NOT_NULL(req_wrap_async)` should be used
before and not after.		 Tobias Nießen <tniessen@tnie.de> no 2025-08-18
sec/33-tls-route-callback-exceptions-through-error-handlers.patch tls: route callback exceptions through error handlers
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.		 Matteo Collina <hello@matteocollina.com> no 2025-12-22
sec/34-lib-add-tlssocket-default-error-handler.patch lib: add TLSSocket default error handler
This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:

```js
const server = http2.createSecureServer({ ... })
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```		 RafaelGSS <rafael.nunu@hotmail.com> no 2025-10-31
sec/35-lib-disable-futimes-when-permission-model-is-enabled.patch lib: disable futimes when permission model is enabled RafaelGSS <rafael.nunu@hotmail.com> no 2025-10-21
sec/36-lib-permission-require-full-read-and-write-to-symlink-apis.patch lib,permission: require full read and write to symlink APIs RafaelGSS <rafael.nunu@hotmail.com> no 2025-11-10
sec/54-add-permission-check-to-realpath-native.patch permission: add permission check to realpath.native RafaelGSS <rafael.nunu@hotmail.com> no 2026-01-05
sec/55-handle-NGHTTP2_ERR_FLOW_CONTROL-error-code.patch src: handle NGHTTP2_ERR_FLOW_CONTROL error code RafaelGSS <rafael.nunu@hotmail.com> no 2026-03-11
sec/CVE-2026-48930.patch dns,net: reject hostnames with embedded NUL bytes Matteo Collina <hello@matteocollina.com> yes upstream backport, https://github.com/nodejs/node/commit/c551a51d0c58dfc91961fb3f24c2c86af6183eca 2026-05-11
sec/CVE-2026-48937_pre1.patch http2: fix graceful session close
Fix issue where session.close() prematurely destroys the session
when response.end() was called with an empty payload while active
http2 streams still existed. This change ensures that sessions are
closed gracefully only after all http2 streams complete and clients
properly receive the GOAWAY frame as per the HTTP/2 spec.		 Kushagra Pandey <pandeykushagra51@gmail.com> no backport, https://github.com/nodejs/node/commit/137717354fb5fef6174eb66421207cd9c46c5096 2025-04-19
sec/CVE-2026-48937.patch deps: fix integration issues with the latest nghttp2
This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.		 Tim Perry <pimterry@gmail.com> yes upstream backport, https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c 2026-04-22
build/openssl_tests.patch Broaden OpenSSL version support in those tests https://github.com/nodejs/node/tree/v24.x/test/parallel/test-tls-alert-handling.js no https://github.com/nodejs/node/tree/v24.x/test/parallel/test-tls-junk-server.js 2026-09-11
build/more_shareable_builtins.patch add acorn, walk to shared builtins Jérémy Lal <kapouer@melix.org> yes 2022-09-28
build/builtins_module_paths_not_shareable.patch disable shared builtins when loading deps on demand This is to avoid preloading potentially missing files. Jérémy Lal <kapouer@melix.org> invalid 2023-12-10
build/doc.patch build doc using marked and js-yaml While waiting for unified/remarked/rehyped modules to be available in debian Jérémy Lal <kapouer@melix.org> not-needed 2021-03-03
build/flag_atomic.patch Link to -latomic by default This avoids surprises on mips*el/ppc*el Jérémy Lal <kapouer@melix.org> not-needed upstream 2019-10-25
build/test_ci.patch adapt tools/test.py * log to stdout
* increase timeout multipliers
* rename --flaky-tests to --flaky-tests-mode and use --flaky-tests like --skip-tests		 Jérémy Lal <kapouer@melix.org> not-needed 2025-02-12
deps/cares.patch keep nodejs compatible with libc-ares public headers Jérémy Lal <kapouer@melix.org> not-needed 2021-10-20
deps/localhost-no-addrconfig.patch do not use dns.ADDRCONFIG for localhost it fails on IPv6-only systems. Setting it with libc fails on linux.
https://github.com/nodejs/node/issues/33279
https://lists.debian.org/debian-devel/2023/12/msg00011.html		 Jérémy Lal <kapouer@melix.org> yes debian 2020-06-11
deps/node_gyp.patch use system-installed node-gyp for building test modules Jérémy Lal <kapouer@melix.org> not-needed 2015-09-09
dfsg/benchmark_without_alice.patch a test uses a benchmark that read alice.html, dfsg excluded Jérémy Lal <kapouer@melix.org> not-needed 2020-03-04
dfsg/multilib_modules.patch Multiarch search path, arch triplet, DFHS path for modules "Bastien ROUCARIÈS" <roucaries.bastien@gmail.com> yes 2020-03-04
dfsg/privacy_breach.patch remove google font from template.html, and link to local Jérémy Lal <kapouer@melix.org> not-needed 2015-09-09
build/skip-buffer-nan-internal-check.patch skip buffer NaN internal representation check this fails on whatever archs having other internal representations of NaN. Jérémy Lal <kapouer@melix.org> yes 2022-05-02
armel/configure.patch allow vfp2 and allow setting arm_version option Jérémy Lal <kapouer@melix.org> yes 2022-08-29
build/doc_template_home.html fix link to home in html api Jérémy Lal <kapouer@melix.org> not-needed 2022-11-06
build/test_process_versions.patch Use system paths for builtins Jérémy Lal <kapouer@melix.org> not-needed 2023-02-22
arm64/stacksize.patch Harmonize V8 stack sizes on ARM architectures to match almost all other architectures James Addison <jay@jp-hosting.net> yes 2023-02-28
build/ada.patch build using ada upstream tarball component Jérémy Lal <kapouer@melix.org> not-needed 2023-11-30
deps/v8-no-static-zlib.patch compile v8 without zlib static lib it should have a minor performance impact Jérémy Lal <kapouer@melix.org> yes 2023-12-16
build/no-deps.patch skip useless files in build target Jérémy Lal <kapouer@melix.org> yes
sec/10-zlib-fix-pointer-alignment.patch zlib: fix pointer alignment
The function AllocForBrotli prefixes the allocated memory with its
size, and returns a pointer to the region after it. This pointer can
however no longer be suitably aligned. Correct this by allocating
the maximum of the the size of the size_t and the max alignment.

On Arm 32bits the size_t is 4 bytes long, but the alignment is 8 for
some NEON instructions. When Brotli is compiled with optimizations
enabled newer GCC versions will use the NEON instructions and trigger
a bus error killing node.

see https://github.com/google/brotli/issues/1159		 jhofstee <jeroen@myspectrum.nl> no 2025-04-09
sec/12-http2-fix-check-for-frame-type-goaway.patch http2: fix check for `frame->hd.type`
Related to CVE-2025-23085
According to the comment, this should be checking whether
`frame->hd.type` is `NGHTTP2_GOAWAY`, i.e. `0x07` and not `0x03`.		 hanguanqiang <hanguanqiang@kylinos.cn> no 2025-04-09
sec/15-fix-os-getinterface-addresses-leak.patch os: fix GetInterfaceAddresses memory lieaky theanarkh <theratliter@gmail.com> no 2025-07-06
sec/37-rethrow-stack-overflow-exceptions-in-async-hooks.patch src: rethrow stack overflow exceptions in async_hooks
When a stack overflow exception occurs during async_hooks callbacks
(which use TryCatchScope::kFatal), detect the specific "Maximum call
stack size exceeded" RangeError and re-throw it instead of immediately
calling FatalException. This allows user code to catch the exception
with try-catch blocks instead of requiring uncaughtException handlers.

The implementation adds IsStackOverflowError() helper to detect stack
overflow RangeErrors and re-throws them in TryCatchScope destructor
instead of calling FatalException.

This fixes the issue where async_hooks would cause stack overflow
exceptions to exit with code 7 (kExceptionInFatalExceptionHandler)
instead of being catchable.		 Matteo Collina <hello@matteocollina.com> no 2025-12-09
sec/38-refactor-unsafe-buffer-creation-to-remove-zero-fill-toggle.patch src,lib: refactor unsafe buffer creation to remove zero-fill toggle

This removes the zero-fill toggle mechanism that allowed JavaScript
to control ArrayBuffer initialization via shared memory. Instead,
unsafe buffer creation now uses a dedicated C++ API.		 Сковорода no 2025-11-07
sec/44-v8-riscv-fix-sp-handling-in-macroassembler-leave-frame.patch deps: V8: backport 6a0a25abaed3
Original commit message:

[riscv] Fix sp handling in MacroAssembler::LeaveFrame

Keep sp <= fp to ensure that data right above fp doesn't get clobbered
by an inopportune signal and its handler.

Such clobbering can happen in e.g. Node.js when JIT-compiled code is
interrupted by a SIGCHLD handler.

Bug: None
Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105069}		 Vivian Wang <wangruikang@iscas.ac.cn> no 2026-02-03
sec/50-crypto-use-timing-safe-comparison-HMAC.patch crypto: use timing-safe comparison in Web Cryptography HMAC
Use `CRYPTO_memcmp` instead of `memcmp` in `HMAC`
Web Cryptography algorithm implementations.		 Filip Skokan <panva.ip@gmail.com> no 2026-02-20
sec/51-fix-array-index-hash-collision.patch deps,build,test: fix array index hash collision
This enables v8_enable_seeded_array_index_hash and add a test for it.



Original commit message:

implement rapidhash secret generation

Bug: 409717082
Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: snek <snek@chromium.org>
Cr-Commit-Position: refs/heads/main@{#101499}



Original commit message:

[numbers] Refactor HashSeed as a lightweight view over ByteArray

Instead of copying the seed and secrets into a struct with value
fields, HashSeed now stores a pointer pointing either into the
read-only ByteArray, or the static default seed for off-heap
HashSeed::Default() calls. The underlying storage is always
8-byte aligned so we can cast it directly into a struct.

Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#105531}



Original commit message:

[strings] improve array index hash distribution

Previously, the hashes stored in a Name's raw_hash_field for decimal
numeric strings (potential array indices) consist of the literal
integer value along with the length of the string. This means
consecutive numeric strings can have consecutive hash values, which
can lead to O(n^2) probing for insertion in the worst case when e.g.
a non-numeric string happen to land in the these buckets.

This patch adds a build-time flag v8_enable_seeded_array_index_hash that
scrambles the 24-bit array-index value stored in a Name's raw_hash_field
to improve the distribution.

x ^= x >> kShift; x = (x * m1) & kMask; // round 1
x ^= x >> kShift; x = (x * m2) & kMask; // round 2
x ^= x >> kShift; // finalize

To decode, apply the same steps with the modular inverses of m1 and m2
in reverse order.

x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1
x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2
x ^= x >> kShift; // finalize

where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask,
m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv,
m2_inv (modular inverses) are precomputed modular inverse of m1 and m2.
The pre-computed values are appended to the hash_seed ByteArray in
ReadOnlyRoots and accessed in generated code to reduce overhead.
In call sites that don't already have access to the seeds, we read them
from the current isolate group/isolate's read only roots.

To consolidate the code that encode/decode these hashes, this patch
adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA
that perform seeding/unseeding if enabled, and updates places where
encoding/decoding of array index is needed to use them.

Bug: 477515021
Change-Id: I350afe511951a54c4378396538152cc56565fd55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#105596}



Original commit message:

[string] add 3rd round to seeded array index hash

Since we already have 3 derived secrets, and arithmetics are
relatively cheap, add a 3rd round to the xorshift-multiply
seeding scheme. This brings the bias from ~3.4 to ~0.4.

Bug: 477515021
Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117
Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105824}		 Joyee Cheung <joyeec9h3@gmail.com> no 2026-01-29
sec/52-http-use-null-prototype-for-headersDistinct-trailersDistinct.patch http: use null prototype for headersDistinct/trailersDistinct
Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.		 Matteo Collina <hello@matteocollina.com> no 2026-02-19
sec/53-include-permission-check-on-lib-fs-promises.patch permission: include permission check on lib/fs/promises RafaelGSS <rafael.nunu@hotmail.com> no 2026-01-05
sec/56-tls-wrap-SNICallback-invocation-in-try-catch.patch tls: wrap SNICallback invocation in try/catch
Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().

Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.		 Matteo Collina <hello@matteocollina.com> no 2026-02-17
sec/CVE-2026-48617.patch permission: handle process.chdir on writereport RafaelGSS <rafael.nunu@hotmail.com> yes upstream backport, https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d 2026-05-11
sec/CVE-2026-48618.patch tls: normalize hostname for server identity checks Matteo Collina <hello@matteocollina.com> no backport, https://github.com/nodejs/node/commit/2197a47144f3356ab451c5dcd858a49eb5957a70 2026-05-11
sec/CVE-2026-48619.patch http2: cap originSet size to prevent unbounded memory growth
A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.		 Matteo Collina <hello@matteocollina.com> no https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8 2026-04-19
sec/CVE-2026-48928.patch tls: fix case-sensitive SNI context matching
The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.		 Matteo Collina <hello@matteocollina.com> no backport, https://github.com/nodejs/node/commit/39d1d0968471a144d93dc293d640008f57d3c58e 2026-04-20
sec/CVE-2026-48931.patch http: fix response queue poisoning in http.Agent
Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.		 Matteo Collina <hello@matteocollina.com> yes upstream https://github.com/nodejs/node/commit/0a22d40180cb796e0d68e94c1a7a8a05a8f47c10 2026-03-29
sec/CVE-2026-48933.patch crypto: guard WebCrypto cipher output length
Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.		 Filip Skokan <panva.ip@gmail.com> yes upstream backport, https://github.com/nodejs/node/commit/38b4c5ed51b2ec81c28fbd379fea72e22fa12a15 2026-05-25
sec/CVE-2026-48934.patch tls: bind reusable sessions to authenticated host Matteo Collina <hello@matteocollina.com> yes upstream backport, https://github.com/nodejs/node/commit/fd890ba01d508ac111bbba302981d7fdf734d2ce 2026-04-13
sec/CVE-2026-48935.patch permission: disable FileHandle utimes with permission model RafaelGSS <rafael.nunu@hotmail.com> yes upstream https://github.com/nodejs/node/commit/28dcd388644c676b5b8149abfe18ec32cd010781 2026-05-11

All known versions for source package 'nodejs'

Links