[Buildroot] [PATCH 1/1] package/nodejs: security bump to v22.23.4

[Buildroot] [PATCH 1/1] package/nodejs: security bump to v22.23.4

[Thomas Perale via buildroot]

This is a security release with multiple fixes, notably updated
certificate following the eMudhra intermediate CA compromise, brotli
remote code execution. For more information see:

- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

See the release logs:
 - https://github.com/nodejs/node/releases/tag/v22.23.4
 - https://github.com/nodejs/node/releases/tag/v22.23.3

This fixes the following vulnerabilities:

- CVE-2026-105481: http: ensure agent data guard works without I/O
- CVE-2026-105482: dns: validate resolve inputs for null bytes
- CVE-2026-106069: tls: reject non-canonical IP addresses
- CVE-2026-106073: permission: check permission model in realpathSync
- CVE-2026-106074: crypto: reset random caches across snapshots
- CVE-2026-111497: src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH
- CVE-2026-111497: deps: brotli: cherry-pick 0ed4268a4401abcb44720963

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/nodejs/nodejs.hash | 12 ++++++------
 package/nodejs/nodejs.mk   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/package/nodejs/nodejs.hash b/package/nodejs/nodejs.hash
index bf7a8358ba..5a9240d4e8 100644
--- a/package/nodejs/nodejs.hash
+++ b/package/nodejs/nodejs.hash
@@ -1,9 +1,9 @@
-# From https://nodejs.org/dist/v22.23.2/SHASUMS256.txt.asc
-sha256  fff4078c5def658577f92c88db7db3bc0072924bfb93fe52c1e744a54e94abb8  node-v22.23.2-linux-arm64.tar.xz
-sha256  ef8f26a3de19acd8c23548e6c3cfc2052610b0e67abb5fd64dbd92c8b1c1245b  node-v22.23.2-linux-armv7l.tar.xz
-sha256  e2ba10110ad34096c051fe47134fcd12175ecc48e7e879d7d4c78b70cf66442c  node-v22.23.2-linux-ppc64le.tar.xz
-sha256  d60acfe00a2932254bb0ad20e01b0d74397a0875595de719654b214f4b03f307  node-v22.23.2-linux-x64.tar.xz
-sha256  bbe768df8d5815d7fa76124052985332452e0a4742d39f32027550d1aab8f6fb  node-v22.23.2.tar.xz
+# From https://nodejs.org/dist/v22.23.4/SHASUMS256.txt.asc
+sha256  6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b  node-v22.23.4-linux-arm64.tar.xz
+sha256  c9057c6a3b8fbb9651ed115c1e96d4a7281b7b9c9ca89fa05865c98ed7ffd437  node-v22.23.4-linux-armv7l.tar.xz
+sha256  e4732f45e0cad787d6ba70c4eb6db45dbdb3f286f67dee429dbc6b4ff36eac43  node-v22.23.4-linux-ppc64le.tar.xz
+sha256  1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce  node-v22.23.4-linux-x64.tar.xz
+sha256  7b9adc82d612d0a2a863d96c46de2292552e250cee51956ebbe0146c42aacae9  node-v22.23.4.tar.xz
 
 # Locally calculated
 sha256  c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4  LICENSE
diff --git a/package/nodejs/nodejs.mk b/package/nodejs/nodejs.mk
index 1147245504..d8ec70af43 100644
--- a/package/nodejs/nodejs.mk
+++ b/package/nodejs/nodejs.mk
@@ -5,7 +5,7 @@
 ################################################################################
 
 # _VERSION, _SOURCE and _SITE must be kept empty to avoid downloading anything
-NODEJS_COMMON_VERSION = 22.23.2
+NODEJS_COMMON_VERSION = 22.23.4
 NODEJS_COMMON_SOURCE = node-v$(NODEJS_COMMON_VERSION).tar.xz
 NODEJS_COMMON_SITE = https://nodejs.org/dist/v$(NODEJS_COMMON_VERSION)
 
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/nodejs: security bump to v22.23.4

[Thomas Petazzoni via buildroot]

On Thu, Oct 22, 2026 at 05:31:02PM +0200, Thomas Perale via buildroot wrote:
> This is a security release with multiple fixes, notably updated
> certificate following the eMudhra intermediate CA compromise, brotli
> remote code execution. For more information see:
> 
> - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
> 
> See the release logs:
>  - https://github.com/nodejs/node/releases/tag/v22.23.4
>  - https://github.com/nodejs/node/releases/tag/v22.23.3
> 
> This fixes the following vulnerabilities:
> 
> - CVE-2026-105481: http: ensure agent data guard works without I/O
> - CVE-2026-105482: dns: validate resolve inputs for null bytes
> - CVE-2026-106069: tls: reject non-canonical IP addresses
> - CVE-2026-106073: permission: check permission model in realpathSync
> - CVE-2026-106074: crypto: reset random caches across snapshots
> - CVE-2026-111497: src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH
> - CVE-2026-111497: deps: brotli: cherry-pick 0ed4268a4401abcb44720963
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot