[meta-oe,scarthgap] nodejs: Security fix for CVE-2026-48619

diff --git a/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48619.patch b/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48619.patch
new file mode 100644
index 0000000000..41377642bb
--- /dev/null
+++ b/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48619.patch
@@ -0,0 +1,253 @@ 
+From c79968e108002c2394bdb9e9cefb2c8c8cc202f8 Mon Sep 17 00:00:00 2001
+From: Matteo Collina <hello@matteocollina.com>
+Date: Sun, 19 Apr 2026 16:48:43 +0200
+Subject: [PATCH] http2: cap originSet size to prevent unbounded memory
+growth
+
+A malicious HTTP/2 server can send repeated ORIGIN frames with unique
+origins, causing unbounded growth of the client-side originSet for the
+lifetime of the session. Cap the set at 128 entries; once full, new
+origins from ORIGIN frames are silently dropped.
+
+Ref: https://hackerone.com/reports/3676863
+PR-URL: https://github.com/nodejs-private/node-private/pull/855
+Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
+Refs: https://hackerone.com/reports/3676863
+
+CVE: CVE-2026-48619
+Upstream-Status: Backport [https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8]
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+---
+ doc/api/errors.md                             |  11 ++
+ doc/api/http2.md                              |   2 +
+ lib/internal/errors.js                        |   2 +
+ lib/internal/http2/core.js                    |  17 ++-
+ .../test-http2-origin-set-max-size.mjs        | 110 ++++++++++++++++++
+ 5 files changed, 141 insertions(+), 1 deletion(-)
+ create mode 100644 test/parallel/test-http2-origin-set-max-size.mjs
+
+diff --git a/doc/api/errors.md b/doc/api/errors.md
+index d6ead7e2..95fa835e 100644
+--- a/doc/api/errors.md
++++ b/doc/api/errors.md
+@@ -1729,6 +1729,17 @@ added: v15.14.0
+ The limit of acceptable invalid HTTP/2 protocol frames sent by the peer,
+ as specified through the `maxSessionInvalidFrames` option, has been exceeded.
+ 
++<a id="ERR_HTTP2_TOO_MANY_ORIGINS"></a>
++
++### `ERR_HTTP2_TOO_MANY_ORIGINS`
++
++<!-- YAML
++added: REPLACEME
++-->
++
++The number of uniq origin sent by the server has exceeded the value defined in
++`options.maxOriginSetSize`.
++
+ <a id="ERR_HTTP2_TRAILERS_ALREADY_SENT"></a>
+ 
+ ### `ERR_HTTP2_TRAILERS_ALREADY_SENT`
+diff --git a/doc/api/http2.md b/doc/api/http2.md
+index 4598b15a..6cf75b80 100644
+--- a/doc/api/http2.md
++++ b/doc/api/http2.md
+@@ -3186,6 +3186,8 @@ changes:
+     This is similar to [`server.maxHeadersCount`][] or
+     [`request.maxHeadersCount`][] in the `node:http` module. The minimum value
+     is `1`. **Default:** `128`.
++  * `maxOriginSetSize` {number} Sets the maximum number of uniq origin the sever
++    can send via ORIGIN frames. **Default:** `128`.
+   * `maxOutstandingPings` {number} Sets the maximum number of outstanding,
+     unacknowledged pings. **Default:** `10`.
+   * `maxReservedRemoteStreams` {number} Sets the maximum number of reserved push
+diff --git a/lib/internal/errors.js b/lib/internal/errors.js
+index 9d6c5ca9..d68a2f7c 100644
+--- a/lib/internal/errors.js
++++ b/lib/internal/errors.js
+@@ -1315,6 +1315,8 @@ E('ERR_HTTP2_STREAM_SELF_DEPENDENCY',
+ E('ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS',
+   'Number of custom settings exceeds MAX_ADDITIONAL_SETTINGS', Error);
+ E('ERR_HTTP2_TOO_MANY_INVALID_FRAMES', 'Too many invalid HTTP/2 frames', Error);
++E('ERR_HTTP2_TOO_MANY_ORIGINS',
++  'The server sent more ORIGIN frames than the allowed number of %s', Error);
+ E('ERR_HTTP2_TRAILERS_ALREADY_SENT',
+   'Trailing headers have already been sent', Error);
+ E('ERR_HTTP2_TRAILERS_NOT_READY',
+diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
+index ebd7abb1..38a33dd0 100644
+--- a/lib/internal/http2/core.js
++++ b/lib/internal/http2/core.js
+@@ -101,6 +101,7 @@ const {
+     ERR_HTTP2_STREAM_ERROR,
+     ERR_HTTP2_STREAM_SELF_DEPENDENCY,
+     ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS,
++    ERR_HTTP2_TOO_MANY_ORIGINS,
+     ERR_HTTP2_TRAILERS_ALREADY_SENT,
+     ERR_HTTP2_TRAILERS_NOT_READY,
+     ERR_HTTP2_UNSUPPORTED_PROTOCOL,
+@@ -237,6 +238,7 @@ const kInit = Symbol('init');
+ const kInfoHeaders = Symbol('sent-info-headers');
+ const kLocalSettings = Symbol('local-settings');
+ const kNativeFields = Symbol('kNativeFields');
++const kMaxOriginSetSize = Symbol('max-ORIGIN-set-size');
+ const kOptions = Symbol('options');
+ const kOwner = owner_symbol;
+ const kOrigin = Symbol('origin');
+@@ -674,8 +676,13 @@ function onOrigin(origins) {
+   if (!session.encrypted || session.destroyed)
+     return undefined;
+   const originSet = initOriginSet(session);
+-  for (let n = 0; n < origins.length; n++)
++  for (let n = 0; n < origins.length; n++) {
++    if (originSet.size >= session[kMaxOriginSetSize]) {
++      session.destroy(new ERR_HTTP2_TOO_MANY_ORIGINS(session[kMaxOriginSetSize]));
++      return;
++    }
+     originSet.add(origins[n]);
++  }
+   session.emit('origin', origins);
+ }
+ 
+@@ -3331,6 +3338,13 @@ function connect(authority, options, listener) {
+   assertIsObject(options, 'options');
+   options = { ...options };
+ 
++  let { maxOriginSetSize } = options;
++  if (maxOriginSetSize != null) {
++    validateNumber(maxOriginSetSize, 'options.maxOriginSetSize', 0);
++  } else {
++    maxOriginSetSize = 128;
++  }
++
+   assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
+   if (options.remoteCustomSettings) {
+     options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
+@@ -3377,6 +3391,7 @@ function connect(authority, options, listener) {
+ 
+   session[kAuthority] = `${options.servername || host}:${port}`;
+   session[kProtocol] = protocol;
++  session[kMaxOriginSetSize] = maxOriginSetSize;
+ 
+   if (typeof listener === 'function')
+     session.once('connect', listener);
+diff --git a/test/parallel/test-http2-origin-set-max-size.mjs b/test/parallel/test-http2-origin-set-max-size.mjs
+new file mode 100644
+index 00000000..08bdf1ed
+--- /dev/null
++++ b/test/parallel/test-http2-origin-set-max-size.mjs
+@@ -0,0 +1,110 @@
++import {
++  expectsError,
++  hasCrypto,
++  mustCall,
++  mustNotCall,
++  mustSucceed,
++  skip,
++} from '../common/index.mjs';
++import * as fixtures from '../common/fixtures.mjs';
++import assert from 'node:assert';
++
++if (!hasCrypto)
++  skip('missing crypto');
++
++const {
++  createSecureServer,
++  connect,
++} = await import('node:http2');
++
++const key = fixtures.readKey('agent8-key.pem', 'binary');
++const cert = fixtures.readKey('agent8-cert.pem', 'binary');
++const ca = fixtures.readKey('fake-startcom-root-cert.pem', 'binary');
++
++const server = createSecureServer({ key, cert });
++server.on('stream', (stream) => {
++  stream.respond();
++  stream.end('ok');
++});
++server.on('session', (session) => {
++  let i = 0;
++  const timer = setInterval(() => {
++    try {
++      session.origin(...Array.from({ length: 10 }, () => `https://o${i++}.example.com`));
++    } catch {
++      clearInterval(timer);
++    }
++  }, 10);
++
++  session.on('close', () => {
++    clearInterval(timer);
++  });
++});
++
++await new Promise((resolve) => server.listen(0, resolve));
++
++// Test fantasist values
++[Symbol(), '0', 1n, {}, [], true, false, /s/, () => {}].forEach((maxOriginSetSize) => {
++  assert.throws(
++    () => connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize }),
++    { code: 'ERR_INVALID_ARG_TYPE' },
++  );
++});
++[NaN, -1].forEach((maxOriginSetSize) => {
++  assert.throws(
++    () => connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize }),
++    { code: 'ERR_OUT_OF_RANGE' },
++  );
++});
++
++await new Promise((resolve) => server.getConnections(mustSucceed((count) => {
++  assert.strictEqual(count, 0);
++  resolve();
++})));
++
++// Test default value
++await new Promise((resolve) => {
++  const client = connect(`https://localhost:${server.address().port}`, { ca });
++
++  client.on('origin', mustCall(12)); // Default value is 128, the first 12 frames should pass, the 13th one should error
++  client.on('error', expectsError({
++    code: 'ERR_HTTP2_TOO_MANY_ORIGINS',
++  }));
++  client.on('goaway', mustNotCall());
++  client.on('close', resolve);
++
++  client.request().resume();
++});
++
++// Test non-default values
++await Promise.all([-0, 9, 1.5].map((maxOriginSetSize) => new Promise((resolve) => {
++  const client = connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize });
++
++  client.on('origin', mustNotCall()); // The server send 10 origins on the first frame, that's already too many.
++  client.on('error', expectsError({
++    code: 'ERR_HTTP2_TOO_MANY_ORIGINS',
++  }));
++  client.on('goaway', mustNotCall());
++  client.on('close', resolve);
++
++  client.request().resume();
++})));
++
++
++// Test values higher than the default value
++await Promise.all([512, Infinity].map((maxOriginSetSize) => new Promise((resolve) => {
++  const client = connect(`https://localhost:${server.address().port}`, { ca, maxOriginSetSize });
++
++  client.on('origin', mustCall(() => {
++    if (client.originSet.length > 128) {
++      client.destroy();
++    }
++  }, 13));
++  client.on('error', mustNotCall());
++  client.on('goaway', mustNotCall());
++  client.on('close', resolve);
++
++  client.request().resume();
++})));
++
++server.close();
+-- 
+2.44.4
+
diff --git a/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb b/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
index 4badec2135..710ed988d3 100644
--- a/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
+++ b/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
@@ -27,6 +27,7 @@  SRC_URI = "http://nodejs.org/dist/v${PV}/node-v${PV}.tar.xz \
            file://0001-Revert-stop-using-deprecated-ares_query.patch \
            file://run-ptest \
            file://CVE-2026-48617.patch \
+           file://CVE-2026-48619.patch \
            "
 SRC_URI:append:class-target = " \
            file://0001-Using-native-binaries.patch \