[From nobody Mon Apr 6 11:07:08 2026 Received: (at submit) by bugs.debian.org; 23 Jan 2026 15:29:37 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, KHOP_HELO_FCRDNS,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED, RDNS_DYNAMIC,SPF_HELO_NONE,SPF_NONE,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 27; hammy, 150; neutral, 131; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: from c-82-192-244-13.customer.ggaweb.ch ([82.192.244.13]:49226 helo=eldamar.lan) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1vjJ6P-00D88q-0z for submit@bugs.debian.org; Fri, 23 Jan 2026 15:29:37 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: node-diff: CVE-2026-24001 Message-ID: <176918217628.3201709.2355265828970849373.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Fri, 23 Jan 2026 16:29:36 +0100 Delivered-To: submit@bugs.debian.org U291cmNlOiBub2RlLWRpZmYKVmVyc2lvbjogNS4wLjB+ZGZzZyt+NS4wLjEtNApTZXZlcml0eTog aW1wb3J0YW50ClRhZ3M6IHNlY3VyaXR5IHVwc3RyZWFtCkZvcndhcmRlZDogaHR0cHM6Ly9naXRo dWIuY29tL2twZGVja2VyL2pzZGlmZi9pc3N1ZXMvNjUzClgtRGViYnVncy1DYzogY2FybmlsQGRl Ymlhbi5vcmcsIERlYmlhbiBTZWN1cml0eSBUZWFtIDx0ZWFtQHNlY3VyaXR5LmRlYmlhbi5vcmc+ CgpIaSwKClRoZSBmb2xsb3dpbmcgdnVsbmVyYWJpbGl0eSB3YXMgcHVibGlzaGVkIGZvciBub2Rl LWRpZmYuCgpDVkUtMjAyNi0yNDAwMVswXToKfCBqc2RpZmYgaXMgYSBKYXZhU2NyaXB0IHRleHQg ZGlmZmVyZW5jaW5nIGltcGxlbWVudGF0aW9uLiBQcmlvciB0bwp8IHZlcnNpb25zIDguMC4zLCA1 LjIuMiwgYW5kIDQuMC40LCBhdHRlbXB0aW5nIHRvIHBhcnNlIGEgcGF0Y2ggd2hvc2UKfCBmaWxl bmFtZSBoZWFkZXJzIGNvbnRhaW4gdGhlIGxpbmUgYnJlYWsgY2hhcmFjdGVycyBgXHJgLCBgXHUy MDI4YCwKfCBvciBgXHUyMDI5YCBjYW4gY2F1c2UgdGhlIGBwYXJzZVBhdGNoYCBtZXRob2QgdG8g ZW50ZXIgYW4gaW5maW5pdGUKfCBsb29wLiBJdCB0aGVuIGNvbnN1bWVzIG1lbW9yeSB3aXRob3V0 IGxpbWl0IHVudGlsIHRoZSBwcm9jZXNzCnwgY3Jhc2hlcyBkdWUgdG8gcnVubmluZyBvdXQgb2Yg bWVtb3J5LiBBcHBsaWNhdGlvbnMgYXJlIHRoZXJlZm9yZQp8IGxpa2VseSB0byBiZSB2dWxuZXJh YmxlIHRvIGEgZGVuaWFsLW9mLXNlcnZpY2UgYXR0YWNrIGlmIHRoZXkgY2FsbAp8IGBwYXJzZVBh dGNoYCB3aXRoIGEgdXNlci1wcm92aWRlZCBwYXRjaCBhcyBpbnB1dC4gQSBsYXJnZSBwYXlsb2Fk IGlzCnwgbm90IG5lZWRlZCB0byB0cmlnZ2VyIHRoZSB2dWxuZXJhYmlsaXR5LCBzbyBzaXplIGxp bWl0cyBvbiB1c2VyCnwgaW5wdXQgZG8gbm90IHByb3ZpZGUgYW55IHByb3RlY3Rpb24uIEZ1cnRo ZXJtb3JlLCBzb21lIGFwcGxpY2F0aW9ucwp8IG1heSBiZSB2dWxuZXJhYmxlIGV2ZW4gd2hlbiBj YWxsaW5nIGBwYXJzZVBhdGNoYCBvbiBhIHBhdGNoCnwgZ2VuZXJhdGVkIGJ5IHRoZSBhcHBsaWNh dGlvbiBpdHNlbGYgaWYgdGhlIHVzZXIgaXMgbm9uZXRoZWxlc3MgYWJsZQp8IHRvIGNvbnRyb2wg dGhlIGZpbGVuYW1lIGhlYWRlcnMgKGUuZy4gYnkgZGlyZWN0bHkgcHJvdmlkaW5nIHRoZQp8IGZp bGVuYW1lcyBvZiB0aGUgZmlsZXMgdG8gYmUgZGlmZmVkKS4gVGhlIGBhcHBseVBhdGNoYCBtZXRo b2QgaXMKfCBzaW1pbGFybHkgYWZmZWN0ZWQgaWYgKGFuZCBvbmx5IGlmKSBjYWxsZWQgd2l0aCBh IHN0cmluZwp8IHJlcHJlc2VudGF0aW9uIG9mIGEgcGF0Y2ggYXMgYW4gYXJndW1lbnQsIHNpbmNl IHVuZGVyIHRoZSBob29kIGl0CnwgcGFyc2VzIHRoYXQgc3RyaW5nIHVzaW5nIGBwYXJzZVBhdGNo YC4gT3RoZXIgbWV0aG9kcyBvZiB0aGUgbGlicmFyeQp8IGFyZSB1bmFmZmVjdGVkLiBGaW5hbGx5 LCBhIHNlY29uZCBhbmQgbGVzc2VyIGludGVyZGVwZW5kZW50IGJ1ZyAtIGEKfCBSZURPUyAtIGFs c28gZXhoaWJpdHMgd2hlbiB0aG9zZSBzYW1lIGxpbmUgYnJlYWsgY2hhcmFjdGVycyBhcmUKfCBw cmVzZW50IGluIGEgcGF0Y2gncyAqcGF0Y2gqIGhlYWRlciAoYWxzbyBrbm93biBhcyBpdHMgImxl YWRpbmcKfCBnYXJiYWdlIikuIEEgbWFsaWNpb3VzbHktY3JhZnRlZCBwYXRjaCBoZWFkZXIgb2Yg bGVuZ3RoICpuKiBjYW4gdGFrZQp8IGBwYXJzZVBhdGNoYCBPKCpuKsKzKSB0aW1lIHRvIHBhcnNl LiBWZXJzaW9ucyA4LjAuMywgNS4yLjIsIGFuZCA0LjAuNAp8IGNvbnRhaW4gYSBmaXguIEFzIGEg d29ya2Fyb3VuZCwgZG8gbm90IGF0dGVtcHQgdG8gcGFyc2UgcGF0Y2hlcyB0aGF0CnwgY29udGFp biBhbnkgb2YgdGhlc2UgY2hhcmFjdGVyczogYFxyYCwgYFx1MjAyOGAsIG9yIGBcdTIwMjlgLgoK CklmIHlvdSBmaXggdGhlIHZ1bG5lcmFiaWxpdHkgcGxlYXNlIGFsc28gbWFrZSBzdXJlIHRvIGlu Y2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykgaWQgaW4g eW91ciBjaGFuZ2Vsb2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1hdGlvbiBzZWU6CgpbMF0g aHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNi0yNDAw MQogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYtMjQwMDEKWzFd IGh0dHBzOi8vZ2l0aHViLmNvbS9rcGRlY2tlci9qc2RpZmYvaXNzdWVzLzY1MwpbMl0gaHR0cHM6 Ly9naXRodWIuY29tL2twZGVja2VyL2pzZGlmZi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNzNy ci1oaDRnLWZwZ3gKWzNdIGh0dHBzOi8vZ2l0aHViLmNvbS9rcGRlY2tlci9qc2RpZmYvcHVsbC82 NDkKClBsZWFzZSBhZGp1c3QgdGhlIGFmZmVjdGVkIHZlcnNpb25zIGluIHRoZSBCVFMgYXMgbmVl ZGVkLgoKUmVnYXJkcywKU2FsdmF0b3JlCg== ]