FEDORA-2026-c99f9dc3b1 — security update for nodejs20

stable

nodejs20-20.20.2-3.fc44

FEDORA-2026-c99f9dc3b1 created by tjuhasz 3 months ago for Fedora 44

Update to version 20.20.2

Automatic update for nodejs20-20.20.0-7.fc44.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-c99f9dc3b1

This update has been submitted for testing by tjuhasz.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update has obsoleted nodejs20-20.20.0-7.fc44, and has inherited its bugs and notes.

3 months ago

tjuhasz edited this update.

3 months ago

This update's test gating status has been changed to 'failed'.

3 months ago

This update has been pushed to testing.

3 months ago

This update's test gating status has been changed to 'waiting'.

2 months ago

This update's test gating status has been changed to 'passed'.

2 months ago

This update has been submitted for stable by bodhi.

2 months ago

This update has been pushed to stable.

2 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

3 months ago

in testing

3 months ago

in stable

2 months ago

modified

3 months ago

approved

2 months ago

Builds

nodejs20-20.20.2-3.fc44

BZ#2438837 nodejs20 does not own/provide /usr/lib/node_modules directory

BZ#2453563 CVE-2026-21717 nodejs20: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]

BZ#2453567 CVE-2026-21714 nodejs20: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames [fedora-all]

BZ#2453570 CVE-2026-21713 nodejs20: Node.js: Information disclosure via timing oracle in HMAC verification [fedora-all]

BZ#2453592 CVE-2026-21716 nodejs20: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]

BZ#2453596 CVE-2026-21715 nodejs20: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]

BZ#2453599 CVE-2026-21710 nodejs20: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]

nodejs20-20.20.2-3.fc44

Automated Test Results

passed