-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 24 Mar 2026 22:11:25 +0100
Source: nodejs
Binary: nodejs-doc
Architecture: all
Version: 20.19.2+dfsg-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Jérémy Lal <kapouer@melix.org>
Description:
 nodejs-doc - API documentation for Node.js, the javascript platform
Changes:
 nodejs (20.19.2+dfsg-1+deb13u2) trixie-security; urgency=medium
 .
   * Upstream security patches:
     + CVE-2026-21713: use timing-safe comparison in Web Cryptography HMAC
     + CVE-2026-21717: fix array index hash collision
     + CVE-2026-21710: http: use null prototype for headersDistinct/trailersDistinct
     + CVE-2026-21716: include permission check on lib/fs/promises
     + CVE-2026-21715: add permission check to realpath.native
     + CVE-2026-21714: handle NGHTTP2_ERR_FLOW_CONTROL error code
     + CVE-2026-21637: tls wrap SNICallback invocation in try/catch
   * copyright: add rapidhash from sec/51 patch
Checksums-Sha1:
 8ae87cb5d1d691c7296aefc1cd79341893405b11 6083840 nodejs-doc_20.19.2+dfsg-1+deb13u2_all.deb
 0b9a6dd51b7b887d0b5b257289cdbe56a788b249 9921 nodejs_20.19.2+dfsg-1+deb13u2_all-buildd.buildinfo
Checksums-Sha256:
 8e236be96ae1ea7570c1dd7e903034820da3c03fd566528d388a2db641a65c21 6083840 nodejs-doc_20.19.2+dfsg-1+deb13u2_all.deb
 4014806515c1eead303aaa3705d13c24483061d2c9623fe8e3dfc2161dff9d38 9921 nodejs_20.19.2+dfsg-1+deb13u2_all-buildd.buildinfo
Files:
 350a956761fb735c4caf392eaa61e443 6083840 doc optional nodejs-doc_20.19.2+dfsg-1+deb13u2_all.deb
 954e64a1870e5ad8037ecccc948dd402 9921 javascript optional nodejs_20.19.2+dfsg-1+deb13u2_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmnEP0YACgkQaBVi67oX
tfmGXA/9GsikMcPQWRKqANo24jFElAmw/6tuwdUIzbvvenQKwp7f8q8cuJ6MQBpY
qubQIXY0zeHEGYryZMxxmO2Cc99HRnsrLMOQAcqJGJMvY1WIqu6kDrkC01Pra/vr
OJj95HD11RE8N+ZxcwjKQKn1lc5+KR/g+ax9wPUZeGSTeV1G3M2K7J4PxkO+Ch6l
EbS0BwT5jBI14Z5U9kG0fYmA7TefDC3Iwylf4SKbT6v3x+6BmabYbQwiQMZs5AV+
s7R5l5Q9aBMVVV7vzmvhTCi9lYAKtmbSc/civAMkR/l5wfkjbBxQLmggc1RXyZ1w
/DBWISKY+9k9BMTx+2VDmaSNPysNqRwgOs1urCL6yA342un6x7H54yGQivJNqc01
yVZIH6k8A5HHy0Ne3nW44yVNX1zdT/6G+Y22W8qDKO/UTdjbDZvV/Gls439fVFlc
AmmEt1NGbyW4i6BSzA6ccC5QSuFeHCvdzjSxQDZV/OolOsoIpp2cNZvbPoaPMWWg
nQ7m+JAyeKxH89thqYB3eoLWCIW4EB6UiVYtp/wc0BwO8Xaj6IKDhCJ//HxiGp7V
hK9Hx8mhwTl9s4JNiysa2VHE3x7VxGgySMspCv9sLTq9Tz8GyAm5kPz7Mcv3Kabt
2/arB/WN9UoerkPMJNLHN9YMXbbij+AADSLDVhN08/STpQDubzM=
=cvi1
-----END PGP SIGNATURE-----