Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7c2835d8 by Salvatore Bonaccorso at 2026-01-14T07:12:17+01:00
Track fixed version for nodejs issues fixed via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,8 +1,8 @@
CVE-2025-55132 [fs.futimes() Bypasses Read-Only Permission Model]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#fsfutimes-bypasses-read-only-permission-model-cve-2025-55132---low
CVE-2026-21637 [TLS PSK/ALPN Callback Exceptions Bypass Error Handlers,
Causing DoS and FD Leak]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium
CVE-2026-21636 [Node.js permission model bypass via unchecked Unix Domain
Socket connections (UDS)]
- nodejs <not-affected> (Only affects Node.js v25)
@@ -11,16 +11,16 @@ CVE-2025-59464 [Memory leak that enables remote Denial of
Service against applic
- nodejs <unfixed>
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#memory-leak-that-enables-remote-denial-of-service-against-applications-processing-tls-client-certificates-cve-2025-59464---medium
CVE-2025-59466 [Uncatchable "Maximum call stack size exceeded" error on
Node.js via async_hooks leads to process crashes bypassing error handlers]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#uncatchable-maximum-call-stack-size-exceeded-error-on-nodejs-via-async_hooks-leads-to-process-crashes-bypassing-error-handlers-cve-2025-59466---medium
CVE-2025-59465 [Node.js HTTP/2 server crashes with unhandled error when
receiving malformed HEADERS frame]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-http2-server-crashes-with-unhandled-error-when-receiving-malformed-headers-frame-cve-2025-59465---high
CVE-2025-55130 [Bypass File System Permissions using crafted symlinks]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#bypass-file-system-permissions-using-crafted-symlinks-cve-2025-55130---high
CVE-2025-55131 [Timeout-based race conditions make Uint8Array/Buffer.alloc
non-zerofilled]
- - nodejs <unfixed>
+ - nodejs 22.22.0+dfsg+~cs22.19.6-1
NOTE:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#timeout-based-race-conditions-make-uint8arraybufferalloc-non-zerofilled-cve-2025-55131---high
CVE-2026-0908
- chromium 144.0.7559.59-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c2835d8d5edfa23285e885eaf5c147bcc64266d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c2835d8d5edfa23285e885eaf5c147bcc64266d
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
