mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 16:24:17 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/nodejs: security bump to v22.23.2

Browse Source 
See the release notes:

- https://github.com/nodejs/node/releases/tag/v22.23.2
- https://github.com/nodejs/node/releases/tag/v22.23.1
- https://github.com/nodejs/node/releases/tag/v22.22.1
- https://github.com/nodejs/node/releases/tag/v22.22.2
- https://github.com/nodejs/node/releases/tag/v22.22.3

It fixes the following vulnerabilities:

- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low

The LICENSE was changed in 22.22.1, see [1].

[1] 9cafec084e

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6f5d678c37)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Thomas Perale
2026-08-26 16:04:14 +02:00
committed by Raphaël Mélotte
parent 03531b4f00
commit a00374d53c
2 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
package/nodejs/nodejs.hash
View File

@@ -1,8 +1,9 @@
# From https://nodejs.org/dist/v22.22.0/SHASUMS256.txt.asc
sha256 1bf1eb9ee63ffc4e5d324c0b9b62cf4a289f44332dfef9607cea1a0d9596ba6f node-v22.22.0-linux-arm64.tar.xz
sha256 a8b4f15f6e1f371422f1f7abcca4c46bd7abc1c732c274bc5cb108b841c1f0ff node-v22.22.0-linux-armv7l.tar.xz
sha256 d83b9957431cc18e1fc143a4b99f89cde7b8a18f53ef392231b4336afd058865 node-v22.22.0-linux-ppc64le.tar.xz
sha256 9aa8e9d2298ab68c600bd6fb86a6c13bce11a4eca1ba9b39d79fa021755d7c37 node-v22.22.0-linux-x64.tar.xz
sha256 4c138012bb5352f49822a8f3e6d1db71e00639d0c36d5b6756f91e4c6f30b683 node-v22.22.0.tar.xz
# From https://nodejs.org/dist/v22.23.2/SHASUMS256.txt.asc
sha256 fff4078c5def658577f92c88db7db3bc0072924bfb93fe52c1e744a54e94abb8 node-v22.23.2-linux-arm64.tar.xz
sha256 ef8f26a3de19acd8c23548e6c3cfc2052610b0e67abb5fd64dbd92c8b1c1245b node-v22.23.2-linux-armv7l.tar.xz
sha256 e2ba10110ad34096c051fe47134fcd12175ecc48e7e879d7d4c78b70cf66442c node-v22.23.2-linux-ppc64le.tar.xz
sha256 d60acfe00a2932254bb0ad20e01b0d74397a0875595de719654b214f4b03f307 node-v22.23.2-linux-x64.tar.xz
sha256 bbe768df8d5815d7fa76124052985332452e0a4742d39f32027550d1aab8f6fb node-v22.23.2.tar.xz
# Locally calculated
sha256 e991d81497a85bb24fc6bffae0a3637a6accd6c6bc5ce1f2c5698bd555cf9d49 LICENSE
sha256 c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4 LICENSE

2
package/nodejs/nodejs.mk
View File

@@ -5,7 +5,7 @@
################################################################################
# _VERSION, _SOURCE and _SITE must be kept empty to avoid downloading anything
NODEJS_COMMON_VERSION = 22.22.0
NODEJS_COMMON_VERSION = 22.23.2
NODEJS_COMMON_SOURCE = node-v$(NODEJS_COMMON_VERSION).tar.xz
NODEJS_COMMON_SITE = https://nodejs.org/dist/v$(NODEJS_COMMON_VERSION)