Package node: Information

Node.js is a server-side JavaScript environment that uses an asynchronous
event-driven model.  Node's goal is to provide an easy way to build scalable
network programs.
- new version 22.22.2 (with rpmrb script)
- set npm >= 10.9.7, libuv >= 1.51.0, c-ares >= 1.34.6
- set zlib >= 1.3.1, llhttp >= 9.3.0
- 22.22.0 fixed CVEs:
 + CVE-2025-59465: Add TLSSocket default error handler
 + CVE-2025-55132: Disable futimes when permission model is enabled
 + CVE-2025-55130: Require full read and write to symlink APIs
 + CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks
 + CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle
 + CVE-2026-21637: Route callback exceptions through error handlers
- 22.22.2 fixed CVEs:
 + CVE-2026-21637: Wrap SNICallback invocation in try/catch (High)
 + CVE-2026-21710: Use null prototype for headersDistinct/trailersDistinct (High)
 + CVE-2026-21713: Use timing-safe comparison in Web Cryptography HMAC (Medium)
 + CVE-2026-21714: Handle NGHTTP2_ERR_FLOW_CONTROL error code (Medium)
 + CVE-2026-21717: Test array index hash collision (Medium)
 + CVE-2026-21715: Add permission check to realpath.native (Low)
 + CVE-2026-21716: Include permission check on lib/fs/promises (Low)
- 2025-08-28, Version 22.19.0 'Jod' (LTS), @aduh95
- disable LTO on %ix86 (ALT bug 56065)
- set npm >= 10.9.3
- 2025-05-21, Version 22.16.0 'Jod' (LTS), @aduh95

Package node: Information

Last changed