[Pkg-javascript-devel] [SECURITY] [DSA 6517-1] nodejs security update

[Jari Ruusu]

I am not sure if you are aware of this, but nodejs binaries update for arm64
computers, version 20.19.2+dfsg-1+deb13u3, is not really available at all.

On x86-64 computers, nodejs binaries and nodejs-doc have been properly
updated to deb13u3 version.

# uname -r -m
6.12.111 x86_64

# dpkg -l "nodejs*" | grep '^ii'
ii  nodejs         20.19.2+dfsg-1+deb13u3 amd64        evented I/O for V8 javascript - runtime executable
ii  nodejs-doc     20.19.2+dfsg-1+deb13u3 all          API documentation for Node.js, the javascript platform

On aarch64/arm64 computers, nodejs binaries have not been updated. nodejs
binaries are stuck at deb13u2, but nodejs-doc is at deb13u3. This "stuck"
situation has been going for days for multiple installations of
aarch64/arm64 systems. Normally computers that I admin get updates installed
daily.

# uname -r -m
6.12.111-2212a45-v8 aarch64

# dpkg -l "nodejs*" | grep '^ii'
ii  nodejs         20.19.2+dfsg-1+deb13u2 arm64        evented I/O for V8 javascript - runtime executable
ii  nodejs-doc     20.19.2+dfsg-1+deb13u3 all          API documentation for Node.js, the javascript platform

Below is copy-pasted text from:

 lynx  https://security-tracker.debian.org/tracker/source-package/nodejs

-------------------------------------------------------------------
Available versions
      Release               Version
bookworm          18.20.4+dfsg-1~deb12u2
trixie            20.19.2+dfsg-1+deb13u2
trixie (security) 20.19.2+dfsg-1+deb13u3
                                 ^^^^^^^
forky             24.21.0+dfsg+~cs24.13.4-1
sid               24.21.0+dfsg+~cs24.13.4-1
-------------------------------------------------------------------

Below is copy-pasted text from:

 lynx  http://security.debian.org/debian-security/pool/main/n/nodejs/
 
-------------------------------------------------------------------
[ ] nodejs-doc_18.20.4+dfsg-1~deb12u2_all.deb 2026-05-10 15:55 3.4M
[ ] nodejs-doc_20.19.2+dfsg-1+deb13u2_all.deb 2026-03-25 20:09 5.8M
[ ] nodejs-doc_20.19.2+dfsg-1+deb13u3_all.deb 2026-09-22 21:51 5.8M
                              ^^^^^^^
[ ] nodejs_18.20.4+dfsg-1~deb12u2.debian.tar.xz 2026-05-10 15:34 185K
[TXT] nodejs_18.20.4+dfsg-1~deb12u2.dsc 2026-05-10 15:34 4.2K
[ ] nodejs_18.20.4+dfsg-1~deb12u2_amd64.deb 2026-05-10 16:45 314K
[ ] nodejs_18.20.4+dfsg-1~deb12u2_arm64.deb 2026-05-10 16:30 314K
[ ] nodejs_18.20.4+dfsg-1~deb12u2_armhf.deb 2026-05-10 18:55 314K
[ ] nodejs_18.20.4+dfsg-1~deb12u2_i386.deb 2026-05-10 19:15 314K
[ ] nodejs_18.20.4+dfsg-1~deb12u2_ppc64el.deb 2026-05-10 16:35 314K
[ ] nodejs_18.20.4+dfsg.orig-ada.tar.xz 2025-08-25 00:13 267K
[ ] nodejs_18.20.4+dfsg.orig-types-node.tar.xz 2025-08-25 00:13 261K
[ ] nodejs_18.20.4+dfsg.orig.tar.xz 2025-08-25 00:13 28M
[ ] nodejs_20.19.2+dfsg-1+deb13u2.debian.tar.xz 2026-03-25 19:49 199K
[TXT] nodejs_20.19.2+dfsg-1+deb13u2.dsc 2026-03-25 19:49 4.3K
[ ] nodejs_20.19.2+dfsg-1+deb13u2_arm64.deb 2026-03-25 21:19 345K
                          ^^^^^^^^^^^^^
[ ] nodejs_20.19.2+dfsg-1+deb13u3.debian.tar.xz 2026-09-22 21:36 232K
[TXT] nodejs_20.19.2+dfsg-1+deb13u3.dsc 2026-09-22 21:36 4.3K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_amd64.deb 2026-09-22 23:16 346K
                          ^^^^^^^^^^^^^
[ ] nodejs_20.19.2+dfsg-1+deb13u3_armel.deb 2026-09-23 04:37 346K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_armhf.deb 2026-09-23 03:37 347K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_i386.deb 2026-09-23 04:22 346K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_ppc64el.deb 2026-09-22 23:06 347K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_riscv64.deb 2026-09-24 13:43 346K
[ ] nodejs_20.19.2+dfsg-1+deb13u3_s390x.deb 2026-09-22 23:27 346K
[ ] nodejs_20.19.2+dfsg.orig-ada.tar.xz 2026-03-13 20:37 268K
[ ] nodejs_20.19.2+dfsg.orig-types-node.tar.xz 2026-03-13 20:37 297K
[ ] nodejs_20.19.2+dfsg.orig.tar.xz 2026-03-13 20:37 19M
-------------------------------------------------------------------

nodejs binaries for deb13u3 arm64 are not there. Firefox web-browser
shows identical problem, viewed from Finland IPv4 address, and also
from USA exit VPN address.

--
Jari Ruusu  4096R/8132F189 12D6 4C3A DCDA 0AA4 27BD  ACDF F073 3C80 8132 F189