diff --git a/SPECS/nodejs/CVE-2026-12151.patch b/SPECS/nodejs/CVE-2026-12151.patch deleted file mode 100644 index 68089b547d3..00000000000 --- a/SPECS/nodejs/CVE-2026-12151.patch +++ /dev/null @@ -1,208 +0,0 @@ -From b7f252e7c0841418fb9d95cd297bdd9fad9d2a53 Mon Sep 17 00:00:00 2001 -From: Matteo Collina -Date: Mon, 15 Jun 2026 15:01:37 +0200 -Subject: [PATCH] Backport WebSocket maxPayloadSize fixes to v7.x (#5423) - (#5428) - -* feat: add configurable maxPayloadSize for WebSocket (#4955) - -(cherry picked from commit bd91f86730c3d597ab8b29a014672deba36d0b5e) - - -* test: fix flaky permessage-deflate limit timeout (#5229) - -(cherry picked from commit 9d82667f8f04268198642a5e21d4b02ebf9727b0) - - -* fix(websocket): enforce max payload size across fragments - -Account for previously received fragment bytes when checking WebSocket payload size limits, so fragmented messages cannot exceed maxPayloadSize by splitting the payload across frames. - -Add coverage for cumulative fragmented payload size enforcement. - - -(cherry picked from commit b4c287b3821a723d8c0912986fd2d8945399728d) - - -* websocket: handle empty fragments and stream limits - -Treat zero-byte frames as real fragments so fragmented messages can start -with an empty frame and empty continuations still count toward -maxFragments. - -Pass dispatcher WebSocket limits through to WebSocketStream's parser, add -regression coverage for WebSocket and WebSocketStream fragment limits, make -the fragment close tests wait for both endpoints, and fix the Client docs -typo for maxFragments. - - -(cherry picked from commit c5ed78756914b17501223dcc345b3a966351604a) - - ---------- - -Signed-off-by: Matteo Collina -Co-authored-by: Matthew Aitken -Co-authored-by: Luigi Pinca -Co-authored-by: Ulises Gascon - -Upstream Patch Reference: https://github.com/nodejs/undici/commit/b7f252e7.patch ---- - .../undici/docs/docs/api/Client.md | 1 + - .../undici/lib/dispatcher/dispatcher-base.js | 1 + - .../undici/lib/web/websocket/receiver.js | 39 +++++++++++++++---- - .../undici/lib/web/websocket/websocket.js | 5 ++- - 4 files changed, 37 insertions(+), 9 deletions(-) - -diff --git a/deps/npm/node_modules/undici/docs/docs/api/Client.md b/deps/npm/node_modules/undici/docs/docs/api/Client.md -index fdee5ea7..e0d41b47 100644 ---- a/deps/npm/node_modules/undici/docs/docs/api/Client.md -+++ b/deps/npm/node_modules/undici/docs/docs/api/Client.md -@@ -27,6 +27,7 @@ Returns: `Client` - * **maxHeaderSize** `number | null` (optional) - Default: `--max-http-header-size` or `16384` - The maximum length of request headers in bytes. Defaults to Node.js' --max-http-header-size or 16KiB. - * **maxResponseSize** `number | null` (optional) - Default: `-1` - The maximum length of response body in bytes. Set to `-1` to disable. - * **webSocket** `WebSocketOptions` (optional) - WebSocket-specific configuration options. -+ * **maxFragments** `number` (optional) - Default: `131072` - Maximum number of fragments in a message. Set to 0 to disable the limit. - * **maxPayloadSize** `number` (optional) - Default: `134217728` (128 MB) - Maximum allowed payload size in bytes for WebSocket messages. Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages. Set to 0 to disable the limit. - * **pipelining** `number | null` (optional) - Default: `1` - The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Carefully consider your workload and environment before enabling concurrent requests as pipelining may reduce performance if used incorrectly. Pipelining is sensitive to network stack settings as well as head of line blocking caused by e.g. long running requests. Set to `0` to disable keep-alive connections. - * **connect** `ConnectOptions | Function | null` (optional) - Default: `null`. -diff --git a/deps/npm/node_modules/undici/lib/dispatcher/dispatcher-base.js b/deps/npm/node_modules/undici/lib/dispatcher/dispatcher-base.js -index c999b2c2..371a3ea1 100644 ---- a/deps/npm/node_modules/undici/lib/dispatcher/dispatcher-base.js -+++ b/deps/npm/node_modules/undici/lib/dispatcher/dispatcher-base.js -@@ -26,6 +26,7 @@ class DispatcherBase extends Dispatcher { - - get webSocketOptions () { - return { -+ maxFragments: this[kWebSocketOptions].maxFragments ?? 131072, - maxPayloadSize: this[kWebSocketOptions].maxPayloadSize ?? 128 * 1024 * 1024 - } - } -diff --git a/deps/npm/node_modules/undici/lib/web/websocket/receiver.js b/deps/npm/node_modules/undici/lib/web/websocket/receiver.js -index 53e427eb..a7dea7fa 100644 ---- a/deps/npm/node_modules/undici/lib/web/websocket/receiver.js -+++ b/deps/npm/node_modules/undici/lib/web/websocket/receiver.js -@@ -20,6 +20,11 @@ const { closeWebSocketConnection } = require('./connection') - const { PerMessageDeflate } = require('./permessage-deflate') - const { MessageSizeExceededError } = require('../../core/errors') - -+function failWebsocketConnectionWithCode (ws, code, reason) { -+ closeWebSocketConnection(ws, code, reason, Buffer.byteLength(reason)) -+ failWebsocketConnection(ws, reason) -+} -+ - // This code was influenced by ws released under the MIT license. - // Copyright (c) 2011 Einar Otto Stangvik - // Copyright (c) 2013 Arnout Kazemier and contributors -@@ -39,19 +44,23 @@ class ByteParser extends Writable { - /** @type {Map} */ - #extensions - -+ /** @type {number} */ -+ #maxFragments -+ - /** @type {number} */ - #maxPayloadSize - - /** - * @param {import('./websocket').WebSocket} ws - * @param {Map|null} extensions -- * @param {{ maxPayloadSize?: number }} [options] -+ * @param {{ maxFragments?: number, maxPayloadSize?: number }} [options] - */ - constructor (ws, extensions, options = {}) { - super() - - this.ws = ws - this.#extensions = extensions == null ? new Map() : extensions -+ this.#maxFragments = options.maxFragments ?? 0 - this.#maxPayloadSize = options.maxPayloadSize ?? 0 - - if (this.#extensions.has('permessage-deflate')) { -@@ -75,9 +84,9 @@ class ByteParser extends Writable { - if ( - this.#maxPayloadSize > 0 && - !isControlFrame(this.#info.opcode) && -- this.#info.payloadLength > this.#maxPayloadSize -+ this.#info.payloadLength + this.#fragmentsBytes > this.#maxPayloadSize - ) { -- failWebsocketConnection(this.ws, 'Payload size exceeds maximum allowed size') -+ failWebsocketConnectionWithCode(this.ws, 1009, 'Payload size exceeds maximum allowed size') - return false - } - -@@ -242,10 +251,12 @@ class ByteParser extends Writable { - this.#state = parserStates.INFO - } else { - if (!this.#info.compressed) { -- this.writeFragments(body) -+ if (!this.writeFragments(body)) { -+ return -+ } - - if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) { -- failWebsocketConnection(this.ws, new MessageSizeExceededError().message) -+ failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message) - return - } - -@@ -264,14 +275,17 @@ class ByteParser extends Writable { - this.#info.fin, - (error, data) => { - if (error) { -- failWebsocketConnection(this.ws, error.message) -+ const code = error instanceof MessageSizeExceededError ? 1009 : 1007 -+ failWebsocketConnectionWithCode(this.ws, code, error.message) - return - } - -- this.writeFragments(data) -+ if (!this.writeFragments(data)) { -+ return -+ } - - if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) { -- failWebsocketConnection(this.ws, new MessageSizeExceededError().message) -+ failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message) - return - } - -@@ -341,8 +355,17 @@ class ByteParser extends Writable { - } - - writeFragments (fragment) { -+ if ( -+ this.#maxFragments > 0 && -+ this.#fragments.length === this.#maxFragments -+ ) { -+ failWebsocketConnectionWithCode(this.ws, 1008, 'Too many message fragments') -+ return false -+ } -+ - this.#fragmentsBytes += fragment.length - this.#fragments.push(fragment) -+ return true - } - - consumeFragments () { -diff --git a/deps/npm/node_modules/undici/lib/web/websocket/websocket.js b/deps/npm/node_modules/undici/lib/web/websocket/websocket.js -index ccedb792..80991e96 100644 ---- a/deps/npm/node_modules/undici/lib/web/websocket/websocket.js -+++ b/deps/npm/node_modules/undici/lib/web/websocket/websocket.js -@@ -435,9 +435,12 @@ class WebSocket extends EventTarget { - // once this happens, the connection is open - this[kResponse] = response - -- const maxPayloadSize = this[kController]?.dispatcher?.webSocketOptions?.maxPayloadSize -+ const webSocketOptions = this[kController]?.dispatcher?.webSocketOptions -+ const maxFragments = webSocketOptions?.maxFragments -+ const maxPayloadSize = webSocketOptions?.maxPayloadSize - - const parser = new ByteParser(this, parsedExtensions, { -+ maxFragments, - maxPayloadSize - }) - parser.on('drain', onParserDrain) --- -2.45.4 - diff --git a/SPECS/nodejs/CVE-2026-15157.patch b/SPECS/nodejs/CVE-2026-15157.patch index 54e20717445..a8e5c825ed3 100644 --- a/SPECS/nodejs/CVE-2026-15157.patch +++ b/SPECS/nodejs/CVE-2026-15157.patch @@ -10,7 +10,7 @@ Upstream-reference: https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js -index ef3d38ea..e5e2924f 100644 +index 9455517a..a801ecb3 100644 --- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js +++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js @@ -10,6 +10,7 @@ const { @@ -21,7 +21,7 @@ index ef3d38ea..e5e2924f 100644 HeadersTimeoutError, HeadersOverflowError, SocketError, -@@ -923,8 +924,16 @@ function writeH1 (client, request) { +@@ -993,8 +994,16 @@ function writeH1 (client, request) { } body = bodyStream.stream contentLength = bodyStream.length diff --git a/SPECS/nodejs/CVE-2026-9679.patch b/SPECS/nodejs/CVE-2026-9679.patch deleted file mode 100644 index 863b630cae2..00000000000 --- a/SPECS/nodejs/CVE-2026-9679.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 25efa447997f74d5881edd144525c3fd7db945a4 Mon Sep 17 00:00:00 2001 -From: Matteo Collina -Date: Thu, 11 Jun 2026 11:24:59 +0200 -Subject: [PATCH] fix(cookies): preserve values and parse SameSite strictly - -Signed-off-by: Matteo Collina -(cherry picked from commit 5655ea43af4add559ee5f94b6cd72e08a55aa621) - -Upstream Patch Reference: https://github.com/nodejs/undici/commit/25efa447.patch ---- - .../undici/lib/web/cookies/parse.js | 39 ++++++++----------- - 1 file changed, 16 insertions(+), 23 deletions(-) - -diff --git a/deps/npm/node_modules/undici/lib/web/cookies/parse.js b/deps/npm/node_modules/undici/lib/web/cookies/parse.js -index 3c48c26b..b3c25fb9 100644 ---- a/deps/npm/node_modules/undici/lib/web/cookies/parse.js -+++ b/deps/npm/node_modules/undici/lib/web/cookies/parse.js -@@ -275,32 +275,25 @@ function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) - // If the attribute-name case-insensitively matches the string - // "SameSite", the user agent MUST process the cookie-av as follows: - -- // 1. Let enforcement be "Default". -- let enforcement = 'Default' -- - const attributeValueLowercase = attributeValue.toLowerCase() -- // 2. If cookie-av's attribute-value is a case-insensitive match for -- // "None", set enforcement to "None". -- if (attributeValueLowercase.includes('none')) { -- enforcement = 'None' -- } - -- // 3. If cookie-av's attribute-value is a case-insensitive match for -- // "Strict", set enforcement to "Strict". -- if (attributeValueLowercase.includes('strict')) { -- enforcement = 'Strict' -+ // 1. If cookie-av's attribute-value is a case-insensitive match for -+ // "None", append an attribute to the cookie-attribute-list with an -+ // attribute-name of "SameSite" and an attribute-value of "None". -+ if (attributeValueLowercase === 'none') { -+ cookieAttributeList.sameSite = 'None' -+ } else if (attributeValueLowercase === 'strict') { -+ // 2. If cookie-av's attribute-value is a case-insensitive match for -+ // "Strict", append an attribute to the cookie-attribute-list with -+ // an attribute-name of "SameSite" and an attribute-value of -+ // "Strict". -+ cookieAttributeList.sameSite = 'Strict' -+ } else if (attributeValueLowercase === 'lax') { -+ // 3. If cookie-av's attribute-value is a case-insensitive match for -+ // "Lax", append an attribute to the cookie-attribute-list with an -+ // attribute-name of "SameSite" and an attribute-value of "Lax". -+ cookieAttributeList.sameSite = 'Lax' - } -- -- // 4. If cookie-av's attribute-value is a case-insensitive match for -- // "Lax", set enforcement to "Lax". -- if (attributeValueLowercase.includes('lax')) { -- enforcement = 'Lax' -- } -- -- // 5. Append an attribute to the cookie-attribute-list with an -- // attribute-name of "SameSite" and an attribute-value of -- // enforcement. -- cookieAttributeList.sameSite = enforcement - } else { - cookieAttributeList.unparsed ??= [] - --- -2.45.4 - diff --git a/SPECS/nodejs/disable-tlsv1-tlsv1-1.patch b/SPECS/nodejs/disable-tlsv1-tlsv1-1.patch index 8f007b1dcc7..4bb86bae231 100644 --- a/SPECS/nodejs/disable-tlsv1-tlsv1-1.patch +++ b/SPECS/nodejs/disable-tlsv1-tlsv1-1.patch @@ -1,8 +1,8 @@ diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc -index 3513afc5..146bed1b 100644 +index 05fc2a00..c62d6cf5 100644 --- a/src/crypto/crypto_context.cc +++ b/src/crypto/crypto_context.cc -@@ -1506,28 +1506,16 @@ void SecureContext::Init(const FunctionCallbackInfo& args) { +@@ -1583,28 +1583,16 @@ void SecureContext::Init(const FunctionCallbackInfo& args) { min_version = 0; max_version = kMaxSupportedVersion; method = TLS_client_method(); diff --git a/SPECS/nodejs/nodejs.signatures.json b/SPECS/nodejs/nodejs.signatures.json index df281e15c6c..20a1f0b1377 100644 --- a/SPECS/nodejs/nodejs.signatures.json +++ b/SPECS/nodejs/nodejs.signatures.json @@ -3,6 +3,6 @@ "btest402.js": "fabaf4dacc13e93d54f825b87ffde18573214b149388a5f96176236dd31d7768", "icu4c-78.3-data-bin-b.zip": "cb751fc5d46e218b6c71d69d9dea7ba98da937e2e41b662ad8313c9363d8b7e2", "icu4c-78.3-data-bin-l.zip": "982619632b78887f1895b063e96e8c3cc7f99283337c8abbd05aa71635de613c", - "node-v24.18.1.tar.xz": "353af024d6716de3962b7d0713f9a4d890d7337dfb8eb4e2fa7b2fbfea2f40f7" + "node-v24.20.0.tar.xz": "4dadfdceb1ad917bdabd5bc215ad36c57ccfc30b61ebf540abe87df2ddb76277" } } diff --git a/SPECS/nodejs/nodejs.spec b/SPECS/nodejs/nodejs.spec index 8445f3933ff..58b5d127c7a 100644 --- a/SPECS/nodejs/nodejs.spec +++ b/SPECS/nodejs/nodejs.spec @@ -1,5 +1,5 @@ # Retrieved from 'deps/npm/package.json' inside the sources tarball. -%define npm_version 11.16.0 +%define npm_version 11.19.0 %global nodejs_datadir %{_datarootdir}/nodejs @@ -15,8 +15,8 @@ Summary: A JavaScript runtime built on Chrome's V8 JavaScript engine. Name: nodejs # WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package. # The version of NPM can be found inside the sources under 'deps/npm/package.json'. -Version: 24.18.1 -Release: 2%{?dist} +Version: 24.20.0 +Release: 1%{?dist} License: BSD AND MIT AND Public Domain AND NAIST-2003 AND Artistic-2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -35,9 +35,7 @@ Patch2: CVE-2024-22195.patch Patch3: CVE-2020-28493.patch Patch4: CVE-2024-34064.patch Patch5: CVE-2025-27516.patch -Patch6: CVE-2026-12151.patch -Patch7: CVE-2026-9679.patch -Patch8: CVE-2026-15157.patch +Patch6: CVE-2026-15157.patch BuildRequires: brotli-devel BuildRequires: c-ares-devel BuildRequires: coreutils >= 8.22 @@ -195,6 +193,12 @@ make cctest %{_prefix}/lib/node_modules/* %changelog +* Tue Sep 01 2026 Aditya Singh - 24.20.0-1 +- Upgrade to 24.20.0 'Krypton' (LTS) (bundled npm 11.19.0). +- Bundled ICU version remains the same as 78.3 +- This upgrade fixes CVE-2026-12151, CVE-2026-9679 +- This upgrade also updates npm dependency: undici to 6.27.0 + * Mon Aug 10 2026 Azure Linux Security Servicing Account - 24.18.1-2 - Patch for CVE-2026-15157 diff --git a/cgmanifest.json b/cgmanifest.json index 22b7db33979..dea637f645f 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -14602,8 +14602,8 @@ "type": "other", "other": { "name": "nodejs", - "version": "24.18.1", - "downloadUrl": "https://nodejs.org/download/release/v24.18.1/node-v24.18.1.tar.xz" + "version": "24.20.0", + "downloadUrl": "https://nodejs.org/download/release/v24.20.0/node-v24.20.0.tar.xz" } } },