-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 24 Mar 2026 22:11:25 +0100 Source: nodejs Binary: libnode-dev libnode115 libnode115-dbgsym nodejs nodejs-dbgsym Architecture: s390x Version: 20.19.2+dfsg-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: s390x Build Daemon (zani) Changed-By: Jérémy Lal Description: libnode-dev - evented I/O for V8 javascript (development files) libnode115 - evented I/O for V8 javascript - runtime library nodejs - evented I/O for V8 javascript - runtime executable Changes: nodejs (20.19.2+dfsg-1+deb13u2) trixie-security; urgency=medium . * Upstream security patches: + CVE-2026-21713: use timing-safe comparison in Web Cryptography HMAC + CVE-2026-21717: fix array index hash collision + CVE-2026-21710: http: use null prototype for headersDistinct/trailersDistinct + CVE-2026-21716: include permission check on lib/fs/promises + CVE-2026-21715: add permission check to realpath.native + CVE-2026-21714: handle NGHTTP2_ERR_FLOW_CONTROL error code + CVE-2026-21637: tls wrap SNICallback invocation in try/catch * copyright: add rapidhash from sec/51 patch Checksums-Sha1: f4f98b061834ea6f496db88375da54fdac4cf238 536944 libnode-dev_20.19.2+dfsg-1+deb13u2_s390x.deb d9018b8c2f5b51aea8d0a8f859423228f8de3e6f 1077972440 libnode115-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb 9641126595cc453c3ed452ec787285a4a0d499ad 12213828 libnode115_20.19.2+dfsg-1+deb13u2_s390x.deb 0eb081a1320165e6cbda05272c3e30581e5893a9 82552 nodejs-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb f91bcede0fa010dab9800943089514a4bc73f846 10793 nodejs_20.19.2+dfsg-1+deb13u2_s390x-buildd.buildinfo 2fb6bfce1849cc977c0633ac12ea3c199fd62012 353340 nodejs_20.19.2+dfsg-1+deb13u2_s390x.deb Checksums-Sha256: b3280c560363a3dcdb5620cf0ba64e70494988826865d031741cbab0c00e06ff 536944 libnode-dev_20.19.2+dfsg-1+deb13u2_s390x.deb 9a07d9936d30ccca317a4dac2c67039411436e9d67b03e675ebcb1499048290e 1077972440 libnode115-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb 5d37339c834dd49411d16f4a5d8b8c074dffd76f4513cb45708ec2575f999de7 12213828 libnode115_20.19.2+dfsg-1+deb13u2_s390x.deb 9d191ec481c47d778ead2f028801f4a711cffd13658b5c550ee4f10555eca727 82552 nodejs-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb ce438e5eae350dee919965bcd76c11726fb3eabbf3ca2adf4b9f7102d4805500 10793 nodejs_20.19.2+dfsg-1+deb13u2_s390x-buildd.buildinfo ee071c41381cc7bee08128501091660f6a2359440ade1b55103ad7c23e4bc1c4 353340 nodejs_20.19.2+dfsg-1+deb13u2_s390x.deb Files: b2cb93e4e5b8fa596d08829920c5a9ed 536944 libdevel optional libnode-dev_20.19.2+dfsg-1+deb13u2_s390x.deb 24b78a47600d7defc5e5135c4e9a582f 1077972440 debug optional libnode115-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb b47b7442ac91825d7eb52efe404f1dc9 12213828 libs optional libnode115_20.19.2+dfsg-1+deb13u2_s390x.deb f0676f6f2160d350a6dfc334cd992e0e 82552 debug optional nodejs-dbgsym_20.19.2+dfsg-1+deb13u2_s390x.deb 7a99b0011d702ccca1094ead04dc54ca 10793 javascript optional nodejs_20.19.2+dfsg-1+deb13u2_s390x-buildd.buildinfo 9717498f9e8fe5d7c1882109169004f4 353340 javascript optional nodejs_20.19.2+dfsg-1+deb13u2_s390x.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgh4msZ+e2PZfd5KckaCrxAR3BY0FAmnEbqsACgkQkaCrxAR3 BY1nog/9H58e/E6DFKPDtFh4Z+LAP83vfjeDL4aYJ4YOrj3QJq8x5elNYWzqs8tZ P6ja3GZFPhqjzZ4eC3MCHVLk2Y8rh1ZQLNoLjznge45aFL4X6kA/pdqU2Z1wrsns 7ZSPTTbIpXnu2H8Cr44b7eMqB5R9i5UUjYU6CVsyh1/NCiL/xbPTn242qnawqv+f AikDGqQynLwYCCyhkO2cSRr/mzlAlF61Lxq0POo7w0Va6LozThIoeDLL5H7xj5mh rZGGR6CFt8yiPeK9cClR7sRlIzQkqZGsa/87H6uIb4cSM94ub1vKImVScYUHNqWP U/YLha1AlLqnV4a0aGOhTkoulZ2MiTq8p5ImGxuaIkpxC2kU5F82HLHyg0YNFVnK Xy/oBiHaqSiNekYXtZqv9BEfL0B4SxNCHhB4huCmn3qGg5oZdxh3mo0vk9PRhZ/i IpudrA+D+6bBdRaw4ebZmvsF4nSIzhNoaCGMMQ1yD/U9lN43bvy0MwyYKRN+1vyq 29Dgld7/Rk5boo8cOJF6TTceizQQGRuc6BkkaFWZk9SNSdmCZJWpQJMCZUH5ozRV u3IIgLcmSjUbtX0LvZAGU2HeqRjDbHeU0Xl7+GqKqcYHHMefq43FfiFoB9EMJFKG ljmpV3VhuCkcM7DyJssmGYImfiMnjqwGtmLrVQOQuBpVZ4v//nM= =PTWy -----END PGP SIGNATURE-----