[From nobody Mon Apr 6 11:37:05 2026 Received: (at submit) by bugs.debian.org; 14 Feb 2026 14:44:16 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.5 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, FVGT_m_MULTI_ODD,KHOP_HELO_FCRDNS,MD5_SHA1_SUM,RDNS_DYNAMIC, SPF_HELO_NONE,SPF_NONE,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 57; hammy, 150; neutral, 195; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: from c-82-192-244-13.customer.ggaweb.ch ([82.192.244.13]:44580 helo=eldamar.lan) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1vrGsa-00A9Ar-1d for submit@bugs.debian.org; Sat, 14 Feb 2026 14:44:16 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: node-qs: CVE-2026-2391 Message-ID: <177108025556.869374.15011113197250662555.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Sat, 14 Feb 2026 15:44:15 +0100 Delivered-To: submit@bugs.debian.org U291cmNlOiBub2RlLXFzClZlcnNpb246IDYuMTQuMStkcyt+Ni4xNC4wLTEKU2V2ZXJpdHk6IGlt cG9ydGFudApUYWdzOiBzZWN1cml0eSB1cHN0cmVhbQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJp YW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoK SGksCgpUaGUgZm9sbG93aW5nIHZ1bG5lcmFiaWxpdHkgd2FzIHB1Ymxpc2hlZCBmb3Igbm9kZS1x cy4KCkNWRS0yMDI2LTIzOTFbMF06CnwgIyMjIFN1bW1hcnkgVGhlIGBhcnJheUxpbWl0YCBvcHRp b24gaW4gcXMgZG9lcyBub3QgZW5mb3JjZSBsaW1pdHMKfCBmb3IgY29tbWEtc2VwYXJhdGVkIHZh bHVlcyB3aGVuIGBjb21tYTogdHJ1ZWAgaXMgZW5hYmxlZCwgYWxsb3dpbmcKfCBhdHRhY2tlcnMg dG8gY2F1c2UgZGVuaWFsLW9mLXNlcnZpY2UgdmlhIG1lbW9yeSBleGhhdXN0aW9uLiBUaGlzIGlz CnwgYSBieXBhc3Mgb2YgdGhlIGFycmF5IGxpbWl0IGVuZm9yY2VtZW50LCBzaW1pbGFyIHRvIHRo ZSBicmFja2V0Cnwgbm90YXRpb24gYnlwYXNzIGFkZHJlc3NlZCBpbiBHSFNBLTZydzctdnB4bS00 OThwIChDVkUtMjAyNS0xNTI4NCkuCnwgIyMjIERldGFpbHMgV2hlbiB0aGUgYGNvbW1hYCBvcHRp b24gaXMgc2V0IHRvIGB0cnVlYCAobm90IHRoZQp8IGRlZmF1bHQsIGJ1dCBjb25maWd1cmFibGUg aW4gYXBwbGljYXRpb25zKSwgcXMgYWxsb3dzIHBhcnNpbmcgY29tbWEtCnwgc2VwYXJhdGVkIHN0 cmluZ3MgYXMgYXJyYXlzIChlLmcuLCBgP3BhcmFtPWEsYixjYCBiZWNvbWVzIGBbJ2EnLAp8ICdi JywgJ2MnXWApLiBIb3dldmVyLCB0aGUgbGltaXQgY2hlY2sgZm9yIGBhcnJheUxpbWl0YCAoZGVm YXVsdDogMjApCnwgYW5kIHRoZSBvcHRpb25hbCB0aHJvd09uTGltaXRFeGNlZWRlZCBvY2N1ciBh ZnRlciB0aGUgY29tbWEtaGFuZGxpbmcKfCBsb2dpYyBpbiBgcGFyc2VBcnJheVZhbHVlYCwgZW5h YmxpbmcgYSBieXBhc3MuIFRoaXMgcGVybWl0cyBjcmVhdGlvbgp8IG9mIGFyYml0cmFyaWx5IGxh cmdlIGFycmF5cyBmcm9tIGEgc2luZ2xlIHBhcmFtZXRlciwgbGVhZGluZyB0bwp8IGV4Y2Vzc2l2 ZSBtZW1vcnkgYWxsb2NhdGlvbi4gICoqVnVsbmVyYWJsZSBjb2RlKiogKGxpYi9wYXJzZS5qczoK fCBsaW5lcyB+NDAtNTApOiBgYGBqcyBpZiAodmFsICYmIHR5cGVvZiB2YWwgPT09ICdzdHJpbmcn ICYmCnwgb3B0aW9ucy5jb21tYSAmJiB2YWwuaW5kZXhPZignLCcpID4gLTEpIHsgwqAgwqAgcmV0 dXJuIHZhbC5zcGxpdCgnLCcpOwp8IH0gIGlmIChvcHRpb25zLnRocm93T25MaW1pdEV4Y2VlZGVk ICYmIGN1cnJlbnRBcnJheUxlbmd0aCA+PQp8IG9wdGlvbnMuYXJyYXlMaW1pdCkgeyDCoCDCoCB0 aHJvdyBuZXcgUmFuZ2VFcnJvcignQXJyYXkgbGltaXQKfCBleGNlZWRlZC4gT25seSAnICsgb3B0 aW9ucy5hcnJheUxpbWl0ICsgJyBlbGVtZW50JyArCnwgKG9wdGlvbnMuYXJyYXlMaW1pdCA9PT0g MSA/ICcnIDogJ3MnKSArICcgYWxsb3dlZCBpbiBhbiBhcnJheS4nKTsgfQp8IHJldHVybiB2YWw7 IGBgYCBUaGUgYHNwbGl0KCcsJylgIHJldHVybnMgdGhlIGFycmF5IGltbWVkaWF0ZWx5LAp8IHNr aXBwaW5nIHRoZSBzdWJzZXF1ZW50IGxpbWl0IGNoZWNrLiBEb3duc3RyZWFtIG1lcmdpbmcgdmlh CnwgYHV0aWxzLmNvbWJpbmVgIGRvZXMgbm90IHByZXZlbnQgYWxsb2NhdGlvbiwgZXZlbiBpZiBp dCBtYXJrcwp8IG92ZXJmbG93cyBmb3Igc3BhcnNlIGFycmF5cy5UaGlzIGRpc2NyZXBhbmN5IGFs bG93cyBhdHRhY2tlcnMgdG8KfCBzZW5kIGEgc2luZ2xlIHBhcmFtZXRlciB3aXRoIG1pbGxpb25z IG9mIGNvbW1hcyAoZS5nLiwKfCBgP3BhcmFtPSwsLCwsLCwsLi4uYCksIGFsbG9jYXRpbmcgbWFz c2l2ZSBhcnJheXMgaW4gbWVtb3J5IHdpdGhvdXQKfCB0cmlnZ2VyaW5nIGxpbWl0cy4gSXQgYnlw YXNzZXMgdGhlIGludGVudCBvZiBgYXJyYXlMaW1pdGAsIHdoaWNoIGlzCnwgZW5mb3JjZWQgY29y cmVjdGx5IGZvciBpbmRleGVkIChgYVswXT1gKSBhbmQgYnJhY2tldCAoYGFbXT1gKQp8IG5vdGF0 aW9ucyAodGhlIGxhdHRlciBmaXhlZCBpbiB2Ni4xNC4xIHBlciBHSFNBLTZydzctdnB4bS00OThw KS4KfCAjIyMgUG9DICoqVGVzdCAxIC0gQmFzaWMgYnlwYXNzOioqIGBgYCBucG0gaW5zdGFsbCBx cyBgYGAgIGBgYGpzCnwgY29uc3QgcXMgPSByZXF1aXJlKCdxcycpOyAgY29uc3QgcGF5bG9hZCA9 ICdhPScgKyAnLCcucmVwZWF0KDI1KTsKfCAvLyAyNiBlbGVtZW50cyBhZnRlciBzcGxpdCAoYnlw YXNzZXMgYXJyYXlMaW1pdDogNSkgY29uc3Qgb3B0aW9ucyA9CnwgeyBjb21tYTogdHJ1ZSwgYXJy YXlMaW1pdDogNSwgdGhyb3dPbkxpbWl0RXhjZWVkZWQ6IHRydWUgfTsgIHRyeSB7IAp8IGNvbnN0 IHJlc3VsdCA9IHFzLnBhcnNlKHBheWxvYWQsIG9wdGlvbnMpOyDCoAp8IGNvbnNvbGUubG9nKHJl c3VsdC5hLmxlbmd0aCk7ICAvLyBPdXRwdXRzOiAyNiAoYnlwYXNzIHN1Y2Nlc3NmdWwpIH0KfCBj YXRjaCAoZSkgeyDCoCBjb25zb2xlLmxvZygnTGltaXQgZW5mb3JjZWQ6JywgZS5tZXNzYWdlKTsg IC8vIE5vdAp8IHRocm93biB9IGBgYCAqKkNvbmZpZ3VyYXRpb246KiogLSBgY29tbWE6IHRydWVg IC0gYGFycmF5TGltaXQ6IDVgIC0KfCBgdGhyb3dPbkxpbWl0RXhjZWVkZWQ6IHRydWVgICBFeHBl Y3RlZDogVGhyb3dzICJBcnJheSBsaW1pdAp8IGV4Y2VlZGVkIiBlcnJvci4gQWN0dWFsOiBQYXJz ZXMgc3VjY2Vzc2Z1bGx5LCBjcmVhdGluZyBhbiBhcnJheSBvZgp8IGxlbmd0aCAyNi4gICAjIyMg SW1wYWN0IERlbmlhbCBvZiBTZXJ2aWNlIChEb1MpIHZpYSBtZW1vcnkKfCBleGhhdXN0aW9uLgoK CklmIHlvdSBmaXggdGhlIHZ1bG5lcmFiaWxpdHkgcGxlYXNlIGFsc28gbWFrZSBzdXJlIHRvIGlu Y2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykgaWQgaW4g eW91ciBjaGFuZ2Vsb2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1hdGlvbiBzZWU6CgpbMF0g aHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNi0yMzkx CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi0yMzkxClsxXSBo dHRwczovL2dpdGh1Yi5jb20vbGpoYXJiL3FzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS13N2Z3 LW1qd3gtdzg4MwpbMl0gaHR0cHM6Ly9naXRodWIuY29tL2xqaGFyYi9xcy9jb21taXQvZjZhN2Fi ZmYxZjEzZDY0NGRiOWIwNWZlNGYyYzk4YWRhNmJmODQ4MgoKUGxlYXNlIGFkanVzdCB0aGUgYWZm ZWN0ZWQgdmVyc2lvbnMgaW4gdGhlIEJUUyBhcyBuZWVkZWQuCgpSZWdhcmRzLApTYWx2YXRvcmUK ]