Bug 2562799

Summary:	CVE-2026-115907 nodejs-pnpm12: zip: Denial of Service via unbounded memory preallocation [fedora-rawhide]
Product:	[Fedora] Fedora	Reporter:	Ronit Dey <rdey>
Component:	nodejs-pnpm12	Assignee:	Andreas Schneider <asn>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	asn
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["051d7b9f-e96e-46ec-8215-aac66c34b33e"]}
Fixed In Version:	nodejs-pnpm12-12.17.0-1.fc46 nodejs-pnpm12-12.17.0-1.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-31 08:45:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2560947

Description Ronit Dey 2026-10-28 11:11:42 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.

Comment 1 Fedora Update System 2026-10-31 08:41:13 UTC

FEDORA-2026-7adfb2bcdd (nodejs-pnpm12-12.17.0-1.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-7adfb2bcdd

Comment 2 Fedora Update System 2026-10-31 08:45:22 UTC

FEDORA-2026-7adfb2bcdd (nodejs-pnpm12-12.17.0-1.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Fedora Update System 2026-10-31 12:20:43 UTC

FEDORA-2026-7d4fcfe6c8 (nodejs-pnpm12-12.17.0-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-7d4fcfe6c8

Comment 4 Fedora Update System 2026-11-01 17:44:53 UTC

FEDORA-2026-7d4fcfe6c8 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-7d4fcfe6c8`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-7d4fcfe6c8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-11-09 01:06:31 UTC

FEDORA-2026-7d4fcfe6c8 (nodejs-pnpm12-12.17.0-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.