nodejs (18.20.4+dfsg-1~deb12u3) bookworm-security; urgency=high

nodejs (18.20.4+dfsg-1~deb12u3) bookworm-security; urgency=high

  * Team upload
  * Fix CVE-2026-48618:
    A flaw in Node.js TLS hostname handling can cause Node.js
    unicode dot separator handling can lead to tls wildcard-depth
    authentication bypass due to resolver and verifier hostname
    normalization mismatch
  * Fix CVE-2026-48618:
    A flaw in Node.js TLS hostname handling can cause Node.js unicode
    dot separator handling can lead to tls wildcard-depth
    authentication bypass due to resolver and verifier hostname
    normalization mismat. This can lead to confidentiality impact
    or bypass of the intended security boundary under
    affected configurations.
  * Fix CVE-2026-48928: case-sensitive SNI context matching
    The regex constructed by server.addContext() lacked the case-insensitive
    flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
    miss their intended context and fall back to the default context. This
    violates RFC 6066 Section 3, which states that DNS hostnames are
    case-insensitive. In mTLS configurations with per-tenant contexts, this
    allowed bypassing client certificate authorization by simply
    uppercasing the SNI hostname.
  * Fix CVE-2026-48930:
    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames
    can lead to silent authority rebinding due to c-string truncation
    in resolver bindings.
  * Fix CVE-2026-48931:
    HTTP Agent can cause a client to accept as valid a response
    that is send before the client has sent the request.
  * Fix CVE-2026-48933:
    A flaw in Node.js WebCrypto implementation can crash the process
    if the input of `subtle.encrypt()` is a multiple of 2GiB.
  * Fix CVE-2026-48934:
    A flaw in Node.js TLS host verification can cause an attacker
    to bypass certification validation.
  * Fix CVE-2026-56846
    A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained
    header blocks evade maxSessionMemory
    and enable remote memory exhaustion.
  * Fix CVE-2026-56848:
    A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()`
    to be called re-entrantly while `nghttp2_session_mem_recv()` is executing,
    resulting in a heap-use-after-free.
  * Fix CVE-2026-56850:
    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array
    key collisions, allowing mutual TLS (mTLS) client identities to be
    reused across requests configured with different client certificates.
  * Fix CVE-2026-58042:
    A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process
    When a DNS Response Contains More Than 256 A Records.
    Repeated triggering of this condition can lead to denial of service.
  * Fix CVE-2026-58040:
    An incomplete fix has been identified in Node.js:
    HTTPS Agent TLS session reuse skips hostname verification across
    identity policies (incomplete fix of CVE-2026-48934).
  * Fix FTBFS due to openssl changes

[dgit import unpatched nodejs 18.20.4+dfsg-1~deb12u3]