mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 03:37:15 +00:00
Code Issues Projects Releases Wiki Activity

nodejs: Security fix for CVE-2026-48619

Browse Source 
Pick patch from [1] also mentioned at Debian tracker in [2]

[1] https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8
[2] https://security-tracker.debian.org/tracker/CVE-2026-48619

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Rohini Sangam authored and Anuj Mittal committed 2026-10-26 10:10:52 +05:30
1 parent 9af60e729b
commit 24c9df0563
2 files changed
+254
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48619.patch
+253
View File
@@ -0,0 +1,253 @@
From c79968e108002c2394bdb9e9cefb2c8c8cc202f8 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sun, 19 Apr 2026 16:48:43 +0200
Subject: [PATCH] http2: cap originSet size to prevent unbounded memory
growth
A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.
Ref: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://hackerone.com/reports/3676863
CVE: CVE-2026-48619
Upstream-Status: Backport [https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8]
Signed-off-by: Rohini Sangam <rsangam@mvista.com>
---
doc/api/errors.md | 11 ++
doc/api/http2.md | 2 +
lib/internal/errors.js | 2 +
lib/internal/http2/core.js | 17 ++-
.../test-http2-origin-set-max-size.mjs | 110 ++++++++++++++++++
5 files changed, 141 insertions(+), 1 deletion(-)
create mode 100644 test/parallel/test-http2-origin-set-max-size.mjs
diff --git a/doc/api/errors.md b/doc/api/errors.md
index d6ead7e2..95fa835e 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1729,6 +1729,17 @@ added: v15.14.0
The limit of acceptable invalid HTTP/2 protocol frames sent by the peer,
as specified through the `maxSessionInvalidFrames` option, has been exceeded.
+<a id="ERR_HTTP2_TOO_MANY_ORIGINS"></a>
+
+### `ERR_HTTP2_TOO_MANY_ORIGINS`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+The number of uniq origin sent by the server has exceeded the value defined in
+`options.maxOriginSetSize`.
+
<a id="ERR_HTTP2_TRAILERS_ALREADY_SENT"></a>
### `ERR_HTTP2_TRAILERS_ALREADY_SENT`
diff --git a/doc/api/http2.md b/doc/api/http2.md
index 4598b15a..6cf75b80 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -3186,6 +3186,8 @@ changes:
This is similar to [`server.maxHeadersCount`][] or
[`request.maxHeadersCount`][] in the `node:http` module. The minimum value
is `1`. **Default:** `128`.
+ * `maxOriginSetSize` {number} Sets the maximum number of uniq origin the sever
+ can send via ORIGIN frames. **Default:** `128`.
* `maxOutstandingPings` {number} Sets the maximum number of outstanding,
unacknowledged pings. **Default:** `10`.
* `maxReservedRemoteStreams` {number} Sets the maximum number of reserved push
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index 9d6c5ca9..d68a2f7c 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1315,6 +1315,8 @@ E('ERR_HTTP2_STREAM_SELF_DEPENDENCY',
E('ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS',
'Number of custom settings exceeds MAX_ADDITIONAL_SETTINGS', Error);
E('ERR_HTTP2_TOO_MANY_INVALID_FRAMES', 'Too many invalid HTTP/2 frames', Error);
+E('ERR_HTTP2_TOO_MANY_ORIGINS',
+ 'The server sent more ORIGIN frames than the allowed number of %s', Error);
E('ERR_HTTP2_TRAILERS_ALREADY_SENT',
'Trailing headers have already been sent', Error);
E('ERR_HTTP2_TRAILERS_NOT_READY',
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index ebd7abb1..38a33dd0 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -101,6 +101,7 @@ const {
ERR_HTTP2_STREAM_ERROR,
ERR_HTTP2_STREAM_SELF_DEPENDENCY,
ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS,
+ ERR_HTTP2_TOO_MANY_ORIGINS,
ERR_HTTP2_TRAILERS_ALREADY_SENT,
ERR_HTTP2_TRAILERS_NOT_READY,
ERR_HTTP2_UNSUPPORTED_PROTOCOL,
@@ -237,6 +238,7 @@ const kInit = Symbol('init');
const kInfoHeaders = Symbol('sent-info-headers');
const kLocalSettings = Symbol('local-settings');
const kNativeFields = Symbol('kNativeFields');
+const kMaxOriginSetSize = Symbol('max-ORIGIN-set-size');
const kOptions = Symbol('options');
const kOwner = owner_symbol;
const kOrigin = Symbol('origin');
@@ -674,8 +676,13 @@ function onOrigin(origins) {
if (!session.encrypted || session.destroyed)
return undefined;
const originSet = initOriginSet(session);
- for (let n = 0; n < origins.length; n++)
+ for (let n = 0; n < origins.length; n++) {
+ if (originSet.size >= session[kMaxOriginSetSize]) {
+ session.destroy(new ERR_HTTP2_TOO_MANY_ORIGINS(session[kMaxOriginSetSize]));
+ return;
+ }
originSet.add(origins[n]);
+ }
session.emit('origin', origins);
}
@@ -3331,6 +3338,13 @@ function connect(authority, options, listener) {
assertIsObject(options, 'options');
options = { ...options };
+ let { maxOriginSetSize } = options;
+ if (maxOriginSetSize != null) {
+ validateNumber(maxOriginSetSize, 'options.maxOriginSetSize', 0);
+ } else {
+ maxOriginSetSize = 128;
+ }
+
assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
if (options.remoteCustomSettings) {
options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
@@ -3377,6 +3391,7 @@ function connect(authority, options, listener) {
session[kAuthority] = `${options.servername || host}:${port}`;
session[kProtocol] = protocol;
+ session[kMaxOriginSetSize] = maxOriginSetSize;
if (typeof listener === 'function')
session.once('connect', listener);
diff --git a/test/parallel/test-http2-origin-set-max-size.mjs b/test/parallel/test-http2-origin-set-max-size.mjs
new file mode 100644
index 00000000..08bdf1ed
--- /dev/null
+++ b/test/parallel/test-http2-origin-set-max-size.mjs
@@ -0,0 +1,110 @@
+import {
+ expectsError,
+ hasCrypto,
+ mustCall,
+ mustNotCall,
+ mustSucceed,
+ skip,
+} from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+import assert from 'node:assert';
+
+if (!hasCrypto)
+ skip('missing crypto');
+
+const {
+ createSecureServer,
+ connect,
+} = await import('node:http2');
+
+const key = fixtures.readKey('agent8-key.pem', 'binary');
+const cert = fixtures.readKey('agent8-cert.pem', 'binary');
+const ca = fixtures.readKey('fake-startcom-root-cert.pem', 'binary');
+
+const server = createSecureServer({ key, cert });
+server.on('stream', (stream) => {
+ stream.respond();
+ stream.end('ok');
+});
+server.on('session', (session) => {
+ let i = 0;
+ const timer = setInterval(() => {
+ try {
+ session.origin(...Array.from({ length: 10 }, () => `https://o${i++}.example.com`));
+ } catch {
+ clearInterval(timer);
+ }
+ }, 10);
+
+ session.on('close', () => {
+ clearInterval(timer);
+ });
+});
+
+await new Promise((resolve) => server.listen(0, resolve));
+
+// Test fantasist values
+[Symbol(), '0', 1n, {}, [], true, false, /s/, () => {}].forEach((maxOriginSetSize) => {
+ assert.throws(
+ () => connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize }),
+ { code: 'ERR_INVALID_ARG_TYPE' },
+ );
+});
+[NaN, -1].forEach((maxOriginSetSize) => {
+ assert.throws(
+ () => connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize }),
+ { code: 'ERR_OUT_OF_RANGE' },
+ );
+});
+
+await new Promise((resolve) => server.getConnections(mustSucceed((count) => {
+ assert.strictEqual(count, 0);
+ resolve();
+})));
+
+// Test default value
+await new Promise((resolve) => {
+ const client = connect(`https://localhost:${server.address().port}`, { ca });
+
+ client.on('origin', mustCall(12)); // Default value is 128, the first 12 frames should pass, the 13th one should error
+ client.on('error', expectsError({
+ code: 'ERR_HTTP2_TOO_MANY_ORIGINS',
+ }));
+ client.on('goaway', mustNotCall());
+ client.on('close', resolve);
+
+ client.request().resume();
+});
+
+// Test non-default values
+await Promise.all([-0, 9, 1.5].map((maxOriginSetSize) => new Promise((resolve) => {
+ const client = connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize });
+
+ client.on('origin', mustNotCall()); // The server send 10 origins on the first frame, that's already too many.
+ client.on('error', expectsError({
+ code: 'ERR_HTTP2_TOO_MANY_ORIGINS',
+ }));
+ client.on('goaway', mustNotCall());
+ client.on('close', resolve);
+
+ client.request().resume();
+})));
+
+
+// Test values higher than the default value
+await Promise.all([512, Infinity].map((maxOriginSetSize) => new Promise((resolve) => {
+ const client = connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize });
+
+ client.on('origin', mustCall(() => {
+ if (client.originSet.length > 128) {
+ client.destroy();
+ }
+ }, 13));
+ client.on('error', mustNotCall());
+ client.on('goaway', mustNotCall());
+ client.on('close', resolve);
+
+ client.request().resume();
+})));
+
+server.close();
--
2.44.4
meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
+1
View File
@@ -27,6 +27,7 @@ SRC_URI = "http://nodejs.org/dist/v${PV}/node-v${PV}.tar.xz \
file://0001-Revert-stop-using-deprecated-ares_query.patch \
file://run-ptest \
file://CVE-2026-48617.patch \
file://CVE-2026-48619.patch \
"
SRC_URI:append:class-target = " \
file://0001-Using-native-binaries.patch \