8000 Update node to 26.12.1 and node-lts to 24.22.1 (security; upstream eMudhra fix, drop carried patches) by bryan-minimal · Pull Request #968 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update node to 26.12.1 and node-lts to 24.22.1 (security; upstream eMudhra fix, drop carried patches) #968

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bryan-minimal merged 1 commit into from
Oct 22, 2026
Merged

Update node to 26.12.1 and node-lts to 24.22.1 (security; upstream eMudhra fix, drop carried patches) #968

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 5 additions & 12 deletions packages/node-lts/build.ncl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,28 +18,21 @@ let zstd = import "../zstd/build.ncl" in
let gtest = import "../gtest/build.ncl" in
let glibc = import "../glibc/build.ncl" in
let gcc = import "../gcc/build.ncl" in
let patch = import "../patch/build.ncl" in

let version = "24.19.0" in
let version = "24.22.1" in
{
name = "node-lts",
build_deps = [
{ file = "build.sh" } | Local,
{
url = "https://nodejs.org/dist/v%{version}/node-v%{version}.tar.gz",
sha256 = "16fe258006a6e86844fbe05b3b5e1e5623ca8d3da54e32d98d9e83234bf25b01",
sha256 = "001773d9bd53fbd27a25efd42aa6a9693ebfe500998ca9bec635e9b6ee79bc91",
} | Source,
# CVE-2026-111943 (eMudhra key compromise): backports of nodejs/node#66871
# (SPKI blocklist in TLS chain verification) and nodejs/node#66877 (drop the
# emSign roots removed in NSS 3.131.1), both merged to main 2026-10-20 and
# unreleased. Build-time only; see the patch headers. Drop both on the first
# release whose changelog lists them.
{ file = "cve-2026-111943-tls-spki-blocklist.patch" } | Local,
{ file = "cve-2026-111943-drop-emsign-roots.patch" } | Local,
# 24.22.1 carries the CVE-2026-111943 fixes upstream (nodejs/node#66871 SPKI
# blocklist, #66877 NSS 3.131.1 roots), so the backports are no longer carried.
base,
make,
pkgconf,
patch,
python,
toolchain,
],
Expand Down Expand Up @@ -126,7 +119,7 @@ let version = "24.19.0" in
# CVE-2026-111943: the emSign roots NSS 3.131.1 removed must be gone from
# the BUNDLED store (what `tls` trusts by default). FAILS on stock node
# (checked against node 26.9.0: all three are present) and
# passes only with cve-2026-111943-drop-emsign-roots.patch.
# passes from 26.12.1 / 24.22.1 on (upstream nodejs/node#66877).
emsign_roots_removed =
{
class = 'Standalone,
Expand Down
24 changes: 4 additions & 20 deletions packages/node-lts/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,31 +6,15 @@ export CC=gcc
tar -xof "node-v${MINIMAL_ARG_VERSION}.tar.gz"
cd "node-v${MINIMAL_ARG_VERSION}"

# Applied by name, never a glob, so a patch that stops being fetched fails the
# build instead of being silently skipped (same convention as packages/node).
# CVE-2026-111943 (compromised eMudhra intermediate keys, Mozilla bug 2083449).
# Backports of nodejs/node#66871 (SPKI blocklist in TLS chain verification) and
# the root-store half of nodejs/node#66877 (drop the emSign roots NSS 3.131.1
# removed). Both merged to node main on 2026-10-20 and are NOT in a release yet;
# see each patch header for the deviations from upstream and when to drop them.
#
# The bundled root store is what `tls` trusts by default (we do not configure
# --use-openssl-ca), so the ca-certificates fix does not reach it; and the
# blocklist is needed even with the roots gone, because a chain through a
# compromised key also verifies against any OTHER store that still carries a
# path to it (system store, a caller's `ca`, the Sectigo cross-sign).
patch -Np1 -i "../cve-2026-111943-tls-spki-blocklist.patch"
patch -Np1 -i "../cve-2026-111943-drop-emsign-roots.patch"

# Prove both landed (patch can exit 0 on an already-applied hunk): the
# blocklist table, its install on every SecureContext, and the root gone.
# CVE-2026-111943 is fixed upstream (nodejs/node#66871 SPKI blocklist,
# #66877 NSS 3.131.1 roots). Fail the build if a future version regresses either.
grep -q "constexpr SpkiHash kBlockedSPKIs" src/crypto/crypto_context.cc &&
grep -q "InstallCertVerifyCallback(sc->ctx_.get());" src/crypto/crypto_context.cc || {
echo "ERROR: CVE-2026-111943 SPKI blocklist patch did not land in src/crypto/crypto_context.cc" >&2
echo "ERROR: upstream CVE-2026-111943 SPKI blocklist missing from src/crypto/crypto_context.cc" >&2
exit 1
}
if grep -q "emSign ECC Root CA - G3" src/node_root_certs.h; then
echo "ERROR: CVE-2026-111943 root removal did not land in src/node_root_certs.h" >&2
echo "ERROR: emSign ECC Root CA - G3 is back in src/node_root_certs.h (CVE-2026-111943)" >&2
exit 1
fi

Expand Down
81 changes: 0 additions & 81 deletions packages/node-lts/cve-2026-111943-drop-emsign-roots.patch
View file
Open in desktop

This file was deleted.

Loading
Loading
0