| Message ID | 20260413185106.1098314-1-skandigraun@gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [meta-oe,1/3] nodejs: mark CVE-2026-21710 patched | expand |
diff --git a/meta-oe/recipes-devtools/nodejs/nodejs_22.22.2.bb b/meta-oe/recipes-devtools/nodejs/nodejs_22.22.2.bb index e6dbc866a1..3a1385f70a 100644 --- a/meta-oe/recipes-devtools/nodejs/nodejs_22.22.2.bb +++ b/meta-oe/recipes-devtools/nodejs/nodejs_22.22.2.bb @@ -215,6 +215,7 @@ python __anonymous () { BBCLASSEXTEND = "native" +CVE_STATUS[CVE-2026-21710] = "fixed-version: fixed since v22.22.2" CVE_STATUS[CVE-2026-21712] = "cpe-incorrect: only v24 and v25 are affected" CVE_STATUS[CVE-2026-21713] = "fixed-version: fixed since v22.22.2" CVE_STATUS[CVE-2026-21714] = "fixed-version: fixed since v22.22.2"
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21710 The CVE is fixed in the current recipe version[1], but NVD tracks it without verison info. Mark it as patched in the recipe. [1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> --- meta-oe/recipes-devtools/nodejs/nodejs_22.22.2.bb | 1 + 1 file changed, 1 insertion(+)