[Git][security-tracker-team/security-tracker][master] Track fixed version for nodejs issues fixed via unstable

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7c2835d8 by Salvatore Bonaccorso at 2026-01-14T07:12:17+01:00
Track fixed version for nodejs issues fixed via unstable

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,8 +1,8 @@
 CVE-2025-55132 [fs.futimes() Bypasses Read-Only Permission Model]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#fsfutimes-bypasses-read-only-permission-model-cve-2025-55132---low
 CVE-2026-21637 [TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium
 CVE-2026-21636 [Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)]
 	- nodejs <not-affected> (Only affects Node.js v25)
@@ -11,16 +11,16 @@ CVE-2025-59464 [Memory leak that enables remote Denial of Service against applic
 	- nodejs <unfixed>
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#memory-leak-that-enables-remote-denial-of-service-against-applications-processing-tls-client-certificates-cve-2025-59464---medium
 CVE-2025-59466 [Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#uncatchable-maximum-call-stack-size-exceeded-error-on-nodejs-via-async_hooks-leads-to-process-crashes-bypassing-error-handlers-cve-2025-59466---medium
 CVE-2025-59465 [Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-http2-server-crashes-with-unhandled-error-when-receiving-malformed-headers-frame-cve-2025-59465---high
 CVE-2025-55130 [Bypass File System Permissions using crafted symlinks]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#bypass-file-system-permissions-using-crafted-symlinks-cve-2025-55130---high
 CVE-2025-55131 [Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled]
-	- nodejs <unfixed>
+	- nodejs 22.22.0+dfsg+~cs22.19.6-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#timeout-based-race-conditions-make-uint8arraybufferalloc-non-zerofilled-cve-2025-55131---high
 CVE-2026-0908
 	- chromium 144.0.7559.59-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c2835d8d5edfa23285e885eaf5c147bcc64266d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c2835d8d5edfa23285e885eaf5c147bcc64266d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260114/ed6f2329/attachment.htm>