Skip to content

Commit 4188fb9

Browse files
authored
[LOW] Patch nodejs for CVE-2025-47279 (#13852)
1 parent 07f3e6d commit 4188fb9

File tree

2 files changed

+43
-1
lines changed

2 files changed

+43
-1
lines changed

SPECS/nodejs/CVE-2025-47279.patch

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 0df25374147ee336e08c3e5a67f98c3a0c9c74fb Mon Sep 17 00:00:00 2001
2+
From: Aninda <[email protected]>
3+
Date: Wed, 21 May 2025 14:52:49 -0400
4+
Subject: [PATCH] Address CVE-2025-47279
5+
Upstream Patch Reference: https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25
6+
7+
---
8+
deps/undici/src/lib/pool.js | 14 ++++++++++++++
9+
1 file changed, 14 insertions(+)
10+
11+
diff --git a/deps/undici/src/lib/pool.js b/deps/undici/src/lib/pool.js
12+
index e3cd3399..86b29d44 100644
13+
--- a/deps/undici/src/lib/pool.js
14+
+++ b/deps/undici/src/lib/pool.js
15+
@@ -73,6 +73,20 @@ class Pool extends PoolBase {
16+
? { ...options.interceptors }
17+
: undefined
18+
this[kFactory] = factory
19+
+
20+
+ this.on('connectionError', (origin, targets, error) => {
21+
+ // If a connection error occurs, we remove the client from the pool,
22+
+ // and emit a connectionError event. They will not be re-used.
23+
+ // Fixes https://github.com/nodejs/undici/issues/3895
24+
+ for (const target of targets) {
25+
+ // Do not use kRemoveClient here, as it will close the client,
26+
+ // but the client cannot be closed in this state.
27+
+ const idx = this[kClients].indexOf(target)
28+
+ if (idx !== -1) {
29+
+ this[kClients].splice(idx, 1)
30+
+ }
31+
+ }
32+
+ })
33+
}
34+
35+
[kGetDispatcher] () {
36+
--
37+
2.34.1
38+

SPECS/nodejs/nodejs18.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Name: nodejs18
66
# WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
77
# The version of NPM can be found inside the sources under 'deps/npm/package.json'.
88
Version: 18.20.3
9-
Release: 5%{?dist}
9+
Release: 6%{?dist}
1010
License: BSD and MIT and Public Domain and NAIST-2003 and Artistic-2.0
1111
Group: Applications/System
1212
Vendor: Microsoft Corporation
@@ -24,6 +24,7 @@ Patch4: CVE-2024-22020.patch
2424
Patch5: CVE-2024-22195.patch
2525
Patch6: CVE-2024-34064.patch
2626
Patch7: CVE-2025-27516.patch
27+
Patch8: CVE-2025-47279.patch
2728
BuildRequires: brotli-devel
2829
BuildRequires: coreutils >= 8.22
2930
BuildRequires: gcc
@@ -124,6 +125,9 @@ make cctest
124125
%{_datadir}/systemtap/tapset/node.stp
125126

126127
%changelog
128+
* Wed May 21 2025 Aninda Pradhan <[email protected]> - 18.20.3-6
129+
- Patch CVE-2025-47279
130+
127131
* Mon Mar 10 2025 Sandeep Karambelkar <[email protected]> - 18.20.3-5
128132
- Patch CVE-2025-27516
129133

0 commit comments

Comments
 (0)