Repository navigation
Node.js 24.21.0 Linux x64: CVE-2026-102010 PBDS build-provenance applicability question #5179
Description
Node.js Version
Not installed (removed from production runtime image)
NPM Version
Use the npm version from the Docker image, not your Windows installation
Operating System
Debian GNU/Linux 13 (Trixie), linux/amd64
Subsystem
Other
Description
Hello Node.js maintainers,
Could you clarify the applicability of the public GCC advisory CVE-2026-102010 to the distributed Node.js 24.21.0 Linux x64 runtime and its statically linked dependencies?
The installed node executable has SHA-256:
7fde7b8afa198da66257f42ee2001d874c7355631e6d1579a5fb5ef1f246df4c
It came from the official Node Docker base pinned at sha256:173f125896c3b47ddf056734c7ea789d04595a6a08769a8f78e0df642781fb66 (Debian Trixie, linux/amd64). A scanner reports GCC-source-package associations at 14.2.0-19; that does not establish affected code in Node itself.
The upstream fix concerns the header-defined __gnu_pbds::priority_queue<..., binary_heap_tag>::erase_if implementation:
gcc-mirror/gcc@aaa8351
- Is the affected template instantiated in this distributed runtime or any statically linked dependency?
- If present, can it be reached through supported Node APIs during normal or attacker-influenced input processing?
- Is a supported corrected binary available, or can you point to build/header provenance or a release-specific applicability statement that establishes exclusion or inclusion of the fix?
We have no reproducer, confirmed vulnerable call path or new vulnerability to disclose. This is a build-provenance/support question about a public advisory, not a claim that Node.js is affected. We understand that replacing a shared libstdc++ package or finding no PBDS symbols does not settle compiled-template applicability. If this requires private triage, please direct us to the appropriate process.
Thank you.
Minimal Reproduction
No response
Output
No response
Before You Submit
- I have looked for issues that already exist before submitting this
- My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask
Activity
clarkeyth-wq commentedon Nov 12, 2026
Following up with the current official 24.22.1 Linux x64 build and a separate native-regex question. This supplements the existing 24.21.0 question; no additional affected-path claim is made.
For the official Node 24.22.1 Linux x64 binary (SHA-256 e32e2d16081cf644f88392934288086e7662529d0d43277c34f7aad2207cfafb), is there build provenance or an existing applicability assessment for CVE-2026-102010?
The finding requires the non-default GNU PBDS binary_heap_tag erase_if template. Runtime libstdc++ package versions do not establish the build-time header contents. We found no matching PBDS symbols, but understand inlining and static dependencies prevent symbol absence from proving non-applicability. Can the release build/source closure establish whether this instantiation is present, or identify a maintained corrected release if affected?
Separately, does the supported runtime or its bundled native dependencies expose caller-controlled patterns to glibc regcomp/regexec (including indirect or internal paths) relevant to CVE-2018-20796 and CVE-2019-9192? The binary has no direct undefined imports of those APIs; we do not equate that with a complete exclusion proof. V8 JavaScript regex is a separate implementation. No Node exploit or new vulnerability is alleged.