Debian alert DLA-4809-1 (nodejs)

From:
             
 
rouca@debian.org
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 4809-1] nodejs security update
Date:
             
 
Thu, 01 Oct 2026 16:52:12 +0200
Message-ID:
             
 
<9b1d7b5a64b99dcea7c51bdab38f6b1e@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4809-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Bastien Roucariès
October 01, 2026                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : nodejs
Version        : 18.20.4+dfsg-1~deb12u3
CVE ID         : CVE-2026-48618 CVE-2026-48928 CVE-2026-48930 CVE-2026-48931 
                 CVE-2026-48933 CVE-2026-48934 CVE-2026-56846 CVE-2026-56848 
                 CVE-2026-56850 CVE-2026-58040 CVE-2026-58042

Multiple vulnerabilities were discovered in Node.js, which could result
in denial of service, incorrect certificate
validation or information disclosure.

For Debian 12 bookworm, these problems have been fixed in version
18.20.4+dfsg-1~deb12u3.

We recommend that you upgrade your nodejs packages.

For the detailed security status of nodejs please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nodejs

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmq+c5wACgkQADoaLapB
CF9Ycw//V4E/up3CNuYFND8eIB5083esGq5PNFQDwaN2otDtBasLFd0hmXb5Yvz6
7fjQ3vTLt5vjiNN4DU7MT1BI4kxdHQDw2I4U8wbfPH4cJDRkpgJGNAh80+7xHcJf
mUEACiKG5YcwhgxwuYa5hYAlH+W2gengtC302Z9xACKyHf1kSviNM1r1tZM+7Hnt
AWnOpn7wDiAU7llrFsGeRmQ/W5ksOSRqZT+Yyey1pfUqwau/kvkEacIv5js/IRMs
bpOIJb7R4vtMyaLDiskQgrTL2sRpSidlawEaQ8tD3WpUQCaY2j6Yl/Xa8T64vyNj
QehnlLsTkW+x5hVfISjzfYDFfEEzVibm6truVJ8rmvagiXbYB1WaaD3orGRcZN6C
BBSSF4Fp3ittAW30QkxYmiJhQYtlqAg7fNY1dJsWh4fNPZTJTzBJvJUf5Mrc2oxY
fX5pw/S6jLbqullVMGkHATEcaEABU7AqugWWy+/cyrlblxADL2Ibu4jbKCHipy/B
mM4vTWCUk4jMJEryebP496pvXRnu64bW6DV3kOC188SsFDD1HWa5DB0OxuZp8Hfp
cpUoowvYjv/Hr41EO5JzrXppBEbpPYzdEwjfN/WKMMXX6ZqULau5dmBVcq2TuuJZ
CT/BgFjJZBr9SuMRhIasWzlyEtz1Nd25DsuGDehw/fM50b5Ky8Q=
=3g7X
-----END PGP SIGNATURE-----