[From nobody Wed Jun 24 09:27:14 2026 Received: (at submit) by bugs.debian.org; 21 May 2026 19:56:12 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA, FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 83; hammy, 150; neutral, 198; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wQ9V5-00Dj5T-2M for submit@bugs.debian.org; Thu, 21 May 2026 19:56:11 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: node-qs: CVE-2026-8723 Message-ID: <177939336888.495628.11629312322891503235.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Thu, 21 May 2026 21:56:08 +0200 Delivered-To: submit@bugs.debian.org U291cmNlOiBub2RlLXFzClZlcnNpb246IDYuMTUuMCtkcyt+Ni4xNS4wLTMKU2V2ZXJpdHk6IGlt cG9ydGFudApUYWdzOiBzZWN1cml0eSB1cHN0cmVhbQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJp YW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoK SGksCgpUaGUgZm9sbG93aW5nIHZ1bG5lcmFiaWxpdHkgd2FzIHB1Ymxpc2hlZCBmb3Igbm9kZS1x cy4KCkNWRS0yMDI2LTg3MjNbMF06CnwgIyMjIFN1bW1hcnkgICAgYHFzLnN0cmluZ2lmeWAgdGhy b3dzIGBUeXBlRXJyb3JgIHdoZW4gY2FsbGVkIHdpdGgKfCBgYXJyYXlGb3JtYXQ6ICdjb21tYSdg IGFuZCBgZW5jb2RlVmFsdWVzT25seTogdHJ1ZWAgb24gYW4gYXJyYXkKfCBjb250YWluaW5nIGBu dWxsYCBvciBgdW5kZWZpbmVkYC4gVGhlIHRocm93IGlzIHN5bmNocm9ub3VzIGFuZCBub3QKfCBo YW5kbGVkIGJ5IGFueSBvZiBxcydzIG51bGwtcmVsYXRlZCBvcHRpb25zIChgc2tpcE51bGxzYCwK fCBgc3RyaWN0TnVsbEhhbmRsaW5nYCkuICAgICMjIyBEZXRhaWxzICAgIEluIHRoZSBjb21tYSAr CnwgYGVuY29kZVZhbHVlc09ubHlgIGJyYW5jaCwgYGxpYi9zdHJpbmdpZnkuanM6MTQ1YCBtYXBw ZWQgdGhlIGFycmF5CnwgdGhyb3VnaCB0aGUgcmF3IGVuY29kZXIgYmVmb3JlIGpvaW5pbmc6ICAg IGBgYGpzICAgIG9iaiA9CnwgdXRpbHMubWF5YmVNYXAob2JqLCBlbmNvZGVyKTsgICAgYGBgICAg IGB1dGlscy5lbmNvZGVgCnwgKGBsaWIvdXRpbHMuanM6MTk1YCkgcmVhZHMgYHN0ci5sZW5ndGhg IHdpdGggbm8gbnVsbCBndWFyZCwgc28gYQp8IGBudWxsYCBvciBgdW5kZWZpbmVkYCBlbGVtZW50 IHRocm93cyBgVHlwZUVycm9yYC4gYHNraXBOdWxsc2AgYW5kCnwgYHN0cmljdE51bGxIYW5kbGlu Z2AgYXJlIGJvdGggY2hlY2tlZCBpbiB0aGUgcGVyLWVsZW1lbnQgbG9vcCBiZWxvdwp8IHRoaXMg bGluZSBhbmQgbmV2ZXIgZ2V0IGEgY2hhbmNlIHRvIHJ1bi4gICAgU2FtZSBjbGFzcyBvZiBidWcg YXMgdGhlCnwgZmlsdGVyLWFycmF5IHBhdGggZml4ZWQgaW4gMGMxODBhNC4gVGhlIHZ1bG5lcmFi bGUgc2hhcGUgb2YgdGhlCnwgY29tbWEgKyBgZW5jb2RlVmFsdWVzT25seWAgYnJhbmNoIHdhcyBp bnRyb2R1Y2VkIGluIDRjNGIyM2QgKCJlbmNvZGUKfCBjb21tYSB2YWx1ZXMgbW9yZSBjb25zaXN0 ZW50bHkiLCBQUiAjNDYzLCAyMDIzLTAxLTE5KSwgZmlyc3QKfCByZWxlYXNlZCBpbiB2Ni4xMS4x LiAgICAjIyMjIFBvQyAgICBgYGBqcyAgICBjb25zdCBxcyA9CnwgcmVxdWlyZSgncXMnKTsgICAg cXMuc3RyaW5naWZ5KHsgYTogW251bGwsICdiJ10gfSwgICAgICB7CnwgYXJyYXlGb3JtYXQ6ICdj b21tYScsIGVuY29kZVZhbHVlc09ubHk6IHRydWUgfSk7ICAgIHFzLnN0cmluZ2lmeSh7CnwgYTog W3VuZGVmaW5lZCwgJ2InXSB9LCB7IGFycmF5Rm9ybWF0OiAnY29tbWEnLCBlbmNvZGVWYWx1ZXNP bmx5Ogp8IHRydWUgfSk7ICAgIHFzLnN0cmluZ2lmeSh7IGE6IFtudWxsXSB9LCAgICAgICAgICAg eyBhcnJheUZvcm1hdDoKfCAnY29tbWEnLCBlbmNvZGVWYWx1ZXNPbmx5OiB0cnVlIH0pOyAgICAv LyBUeXBlRXJyb3I6IENhbm5vdCByZWFkCnwgcHJvcGVydGllcyBvZiBudWxsIChyZWFkaW5nICds ZW5ndGgnKSAgICAvLyAgICAgYXQgZW5jb2RlCnwgKGxpYi91dGlscy5qczoxOTU6MTMpICAgIC8v ICAgICBhdCBPYmplY3QubWF5YmVNYXAKfCAobGliL3V0aWxzLmpzOjMyMjozNykgICAgLy8gICAg IGF0IHN0cmluZ2lmeQp8IChsaWIvc3RyaW5naWZ5LmpzOjE0NToyNSkgICAgYGBgICAgICMjIyMg Rml4CnwgYGxpYi9zdHJpbmdpZnkuanM6MTQ1YCwgYXBwbGllZCBpbiAyMWY4MGIzIG9uIGBtYWlu YCBhbmQgcmVsZWFzZWQgYXMKfCB2Ni4xNS4yOiAgICBgYGBkaWZmICAgIC0gb2JqID0gdXRpbHMu bWF5YmVNYXAob2JqLCBlbmNvZGVyKTsgICAgKwp8IG9iaiA9IHV0aWxzLm1heWJlTWFwKG9iaiwg ZnVuY3Rpb24gKHYpIHsgICAgKyAgICAgcmV0dXJuIHYgPT0gbnVsbCA/CnwgdiA6IGVuY29kZXIo dik7ICAgICsgfSk7ICAgIGBgYCAgICBgbnVsbGAgYW5kIGB1bmRlZmluZWRgIG5vdyBwYXNzCnwg dGhyb3VnaCBgbWF5YmVNYXBgIHVuY2hhbmdlZCBhbmQgcmVhY2ggdGhlIGBqb2luKCcsJylgIHN0 ZXAgYXMtaXMuCnwgRm9yIGB7IGE6IFtudWxsLCAnYiddIH1gIHRoaXMgcHJvZHVjZXMgYGE9LGJg LCBtYXRjaGluZyB0aGUKfCBub24tYGVuY29kZVZhbHVlc09ubHlgIGNvbW1hIHBhdGggKHdoaWNo IGFscmVhZHkgam9pbnMgYmVmb3JlCnwgZW5jb2RpbmcgYW5kIHByb2R1Y2VzIGBhPSUyQ2JgIGZv ciB0aGUgc2FtZSBpbnB1dCkuIFNpbmdsZS1lbGVtZW50CnwgYFtudWxsXWAgYXJyYXlzIHN0aWxs IGNvbGxhcHNlIHZpYSB0aGUgZXhpc3RpbmcgYG9iai5qb2luKCcsJykgfHwKfCBudWxsYCBhbmQg cmVtYWluIHN1YmplY3QgdG8gYHNraXBOdWxsc2AgLyBgc3RyaWN0TnVsbEhhbmRsaW5nYCBpbgp8 IHRoZSBtYWluIGxvb3AuICAgICMjIyBBZmZlY3RlZCB2ZXJzaW9ucyAgICBgPj02LjExLjEgPDYu MTUuMmAg4oCUCnwgZml4ZWQgaW4gdjYuMTUuMi4gICAgVGhlIHZ1bG5lcmFibGUgY29kZSBzaGFw ZSB3YXMgaW50cm9kdWNlZCBpbgp8IDRjNGIyM2QgYW5kIGZpcnN0IHNoaXBwZWQgaW4gdjYuMTEu MS4gRWFybGllciB2ZXJzaW9ucyDigJQgaW5jbHVkaW5nCnwgYWxsIG9mIDYuNy54LCA2LjgueCwg Ni45LngsIDYuMTAueCwgYW5kIDYuMTEuMCDigJQgaW1wbGVtZW50ZWQgdGhlCnwgY29tbWEgKyBg ZW5jb2RlVmFsdWVzT25seWAgcGF0aCBkaWZmZXJlbnRseSAoam9pbmluZyBiZWZvcmUKfCBlbmNv ZGluZykgYW5kIGFyZSBub3QgYWZmZWN0ZWQuIEVtcGlyaWNhbGx5IHZlcmlmaWVkIGFjcm9zcyBy ZWxlYXNlZAp8IHZlcnNpb25zLiAgICAjIyMgSW1wYWN0ICAgIEFwcGxpY2F0aW9uIGNvZGUgdGhh dCBjYWxscwp8IGBxcy5zdHJpbmdpZnlgIHdpdGggYm90aCBgYXJyYXlGb3JtYXQ6ICdjb21tYSdg IGFuZAp8IGBlbmNvZGVWYWx1ZXNPbmx5OiB0cnVlYCAoYm90aCBub24tZGVmYXVsdCkgb24gaW5w dXQgdGhhdCBtYXkKfCBjb250YWluIGEgYG51bGxgIG9yIGB1bmRlZmluZWRgIGFycmF5IGVsZW1l bnQgd2lsbCB0aHJvdwp8IHN5bmNocm9ub3VzbHkgaW5zdGVhZCBvZiBwcm9kdWNpbmcgYSBxdWVy eSBzdHJpbmcuIEluIGEgdHlwaWNhbAp8IE5vZGUuanMgSFRUUCBmcmFtZXdvcmsgKEV4cHJlc3Ms IEZhc3RpZnksIEtvYSwgaGFwaSkgdGhlIHN5bmMgdGhyb3cKfCBpcyBjYXVnaHQgYnkgdGhlIGZy YW1ld29yaydzIGVycm9yIGJvdW5kYXJ5IGFuZCB0aGUgYWZmZWN0ZWQgcmVxdWVzdAp8IHJldHVy bnMgYSA1MDA7IHRoZSB3b3JrZXIgcHJvY2VzcyBkb2VzIG5vdCBleGl0IGFuZCBzdWJzZXF1ZW50 CnwgcmVxdWVzdHMgYXJlIHVuYWZmZWN0ZWQuIFRoZSAia2lsbHMgdGhlIHdvcmtlciBwcm9jZXNz IiBmcmFtaW5nCnwgYXBwbGllcyBvbmx5IHRvIGNhbGwgc2l0ZXMgb3V0c2lkZSBhIHJlcXVlc3Qt aGFuZGxlciBlcnJvciBib3VuZGFyeQp8IChiYWNrZ3JvdW5kIGpvYnMsIHN0YXJ0dXAgcGF0aHMs IHN0cmVhbSBwaXBlbGluZXMpIG9yIHRvIGRlcGxveW1lbnRzCnwgd2l0aCBmcmFtZXdvcmsgZXJy b3IgaGFuZGxpbmcgZXhwbGljaXRseSBkaXNhYmxlZC4gICAgVGhlIHZ1bG5lcmFibGUKfCBpbnB1 dCBpcyBhIGBudWxsYCBvciBgdW5kZWZpbmVkYCBlbnRyeSBpbnNpZGUgYW4gYXJyYXk7IHRoaXMg aXMKfCByZWFjaGFibGUgZnJvbSBKU09OIHJlcXVlc3QgYm9kaWVzIG9yIGZyb20gYXBwbGljYXRp b24gY29kZQp8IGNvbnN0cnVjdGluZyBhcnJheXMgZnJvbSB1c2VyIGlucHV0LCBidXQgbm90IGZy b20gc3RhbmRhcmQgSFRNTCBmb3JtCnwgc3VibWlzc2lvbnMgKHdoaWNoIHByb2R1Y2Ugc3RyaW5n cyBvciBvbWl0dGVkIGZpZWxkcywgbm90IGxpdGVyYWwKfCBgbnVsbGApLgoKCklmIHlvdSBmaXgg dGhlIHZ1bG5lcmFiaWxpdHkgcGxlYXNlIGFsc28gbWFrZSBzdXJlIHRvIGluY2x1ZGUgdGhlCkNW RSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykgaWQgaW4geW91ciBjaGFuZ2Vs b2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1hdGlvbiBzZWU6CgpbMF0gaHR0cHM6Ly9zZWN1 cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNi04NzIzCiAgICBodHRwczov L3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi04NzIzClsxXSBodHRwczovL2dpdGh1 Yi5jb20vbGpoYXJiL3FzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1xOG1qLW03Y3AtNXEyNgpb Ml0gaHR0cHM6Ly9naXRodWIuY29tL2xqaGFyYi9xcy9jb21taXQvMjFmODBiMzNlNWM4YjNmN2Vi YTEwMzRmZmYwZGE0YTRhMzdhMWQ0MQoKUGxlYXNlIGFkanVzdCB0aGUgYWZmZWN0ZWQgdmVyc2lv bnMgaW4gdGhlIEJUUyBhcyBuZWVkZWQuCgpSZWdhcmRzLApTYWx2YXRvcmUK ]