Update Node.js to v21.6.2

This MR contains the following updates:

Package	Type	Update	Change
node	stage	patch	21.6.1-bullseye-slim -> 21.6.2-bullseye-slim

---

Release Notes

nodejs/node

v21.6.2: 2024-02-14, Version 21.6.2 (Current), @​RafaelGSS

Compare Source

Notable changes

This is a security release.

Notable changes

• CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
• CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
• CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
• CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
• CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#​1 v1.5 padding) - (Medium)
• CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
• CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
• CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
• undici version 5.28.3
• libuv version 1.48.0
• OpenSSL version 3.0.13+quic1

Commits

• [8344719369] - crypto: disable PKCS#​1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#​525
• [d093600ac4] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [6cd930e5e8] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [9590c15d3d] - deps: upgrade libuv to 1.48.0 (Santiago Gimeno) #​51698
• [666096298c] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#​528
• [a4edd22e30] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#​497
• [6155a1ffaf] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#​518
• [777509495e] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#​516
• [9d2ac2b3fc] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#​538
• [208b3940c7] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#​505
• [fc2454f29c] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#​528
• [ef3eea20be] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#​517
• [8547196964] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#​540

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Renovate Bot.