[rpms/nodejs22] rawhide: CVE-2026-42338 ip-address HTML escaping fix (rhbz#2487625)

[rpms/nodejs22] rawhide: CVE-2026-42338 ip-address HTML escaping fix (rhbz#2487625)

[tjuhasz]

            A new commit has been pushed.

            Repo   : rpms/nodejs22
            Branch : rawhide
            Commit : f3e5420f374e00aa5040d9a5b6384634ba480ec1
            Author : tjuhasz <tjuhasz@redhat.com>
            Date   : 2026-07-20T09:27:36+00:00
            Stats  : +167/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/nodejs22/c/f3e5420f374e00aa5040d9a5b6384634ba480ec1?branch=rawhide

            Log:
            CVE-2026-42338 ip-address HTML escaping fix (rhbz#2487625)

Created by translating the following commit
from Typescript to Javascript:
  https://github.com/beaugunderson/ip-address/commit/d98f88cfa68abef0e57ec2b48df0049032e50c85

---
diff --git a/0002-CVE-2026-42338-ip-address-security-fix.patch b/0002-CVE-2026-42338-ip-address-security-fix.patch
new file mode 100644
index 0000000..9210882
--- /dev/null
+++ b/0002-CVE-2026-42338-ip-address-security-fix.patch
@@ -0,0 +1,166 @@
+From d98f88cfa68abef0e57ec2b48df0049032e50c85 Mon Sep 17 00:00:00 2001
+From: Beau Gunderson <beau@beaugunderson.com>
+Date: Sun, 27 Apr 2026 10:28:29 -0700
+Subject: [PATCH] CVE-2026-42338 ip-address HTML escaping fix
+
+Fix HTML escaping in ip-address library to prevent XSS vulnerabilities.
+This adds proper HTML escaping for IPv6 address components before
+including them in error HTML output.
+
+Fixes: CVE-2026-42338
+Upstream commit: d98f88cfa68abef0e57ec2b48df0049032e50c85
+---
+ deps/npm/node_modules/ip-address/dist/v6/helpers.js | 9 +++++++++
+ deps/npm/node_modules/ip-address/dist/ipv6.js       | 32 ++++++++++++++----------
+ deps/npm/node_modules/ip-address/package.json       | 2 +-
+ 3 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/deps/npm/node_modules/ip-address/dist/v6/helpers.js b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
+index 1234567..abcdefg 100644
+--- a/deps/npm/node_modules/ip-address/dist/v6/helpers.js
++++ b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
+@@ -1,14 +1,23 @@
+ "use strict";
+ Object.defineProperty(exports, "__esModule", { value: true });
++exports.escapeHtml = escapeHtml;
+ exports.spanAllZeroes = spanAllZeroes;
+ exports.spanAll = spanAll;
+ exports.spanLeadingZeroes = spanLeadingZeroes;
+ exports.simpleGroup = simpleGroup;
++function escapeHtml(s) {
++    return s
++        .replace(/&/g, '&amp;')
++        .replace(/</g, '&lt;')
++        .replace(/>/g, '&gt;')
++        .replace(/"/g, '&quot;')
++        .replace(/'/g, '&#39;');
++}
+ /**
+  * @returns {String} the string with all zeroes contained in a <span>
+  */
+ function spanAllZeroes(s) {
+-    return s.replace(/(0+)/g, '<span class="zero">$1</span>');
++    return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
+ }
+ /**
+  * @returns {String} the string with each character contained in a <span>
+@@ -16,11 +25,11 @@
+ function spanAll(s, offset = 0) {
+     const letters = s.split('');
+     return letters
+-        .map((n, i) => `<span class="digit value-${n} position-${i + offset}">${spanAllZeroes(n)}</span>`)
++        .map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`)
+         .join('');
+ }
+ function spanLeadingZeroesSimple(group) {
+-    return group.replace(/^(0+)/, '<span class="zero">$1</span>');
++    return escapeHtml(group).replace(/^(0+)/, '<span class="zero">$1</span>');
+ }
+ /**
+  * @returns {String} the string with leading zeroes contained in a <span>
+@@ -42,4 +51,3 @@
+         return `<span class="hover-group group-${i + offset}">${spanLeadingZeroesSimple(g)}</span>`;
+     });
+ }
+-//# sourceMappingURL=helpers.js.map
+\ No newline at end of file
+diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
+index 1234567..abcdefg 100644
+--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
++++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
+@@ -17,13 +17,23 @@
+ }) : function(o, v) {
+     o["default"] = v;
+ });
+-var __importStar = (this && this.__importStar) || function (mod) {
+-    if (mod && mod.__esModule) return mod;
+-    var result = {};
+-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+-    __setModuleDefault(result, mod);
+-    return result;
+-};
++var __importStar = (this && this.__importStar) || (function () {
++    var ownKeys = function(o) {
++        ownKeys = Object.getOwnPropertyNames || function (o) {
++            var ar = [];
++            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
++            return ar;
++        };
++        return ownKeys(o);
++    };
++    return function (mod) {
++        if (mod && mod.__esModule) return mod;
++        var result = {};
++        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
++        __setModuleDefault(result, mod);
++        return result;
++    };
++})();
+ Object.defineProperty(exports, "__esModule", { value: true });
+ exports.Address6 = void 0;
+ const common = __importStar(require("./common"));
+@@ -536,7 +546,12 @@
+             this.address4 = new ipv4_1.Address4(this.parsedAddress4);
+             for (let i = 0; i < this.address4.groups; i++) {
+                 if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
+-                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", address.replace(constants4.RE_ADDRESS, this.address4.parsedAddress.map(spanLeadingZeroes4).join('.')));
++                    // The prefix groups haven't been through the bad-character check
++                    // yet, so escape them before including in the error HTML.
++                    const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
++                    const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
++                    const separator = groups.length > 1 ? ':' : '';
++                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+                 }
+             }
+             this.v4 = true;
+@@ -896,10 +911,13 @@
+             formFunction = this.to4in6;
+         }
+         const form = formFunction.call(this);
++        const safeHref = helpers.escapeHtml(`${options.prefix}${form}`);
++        const safeForm = helpers.escapeHtml(form);
+         if (options.className) {
+-            return `<a href="${options.prefix}${form}" class="${options.className}">${form}</a>`;
++            const safeClass = helpers.escapeHtml(options.className);
++            return `<a href="${safeHref}" class="${safeClass}">${safeForm}</a>`;
+         }
+-        return `<a href="${options.prefix}${form}">${form}</a>`;
++        return `<a href="${safeHref}">${safeForm}</a>`;
+     }
+     /**
+      * Groups an address
+@@ -908,13 +926,13 @@
+     group() {
+         if (this.elidedGroups === 0) {
+             // The simple case
+-            return helpers.simpleGroup(this.address).join(':');
++            return helpers.simpleGroup(this.addressMinusSuffix).join(':');
+         }
+         assert(typeof this.elidedGroups === 'number');
+         assert(typeof this.elisionBegin === 'number');
+         // The elided case
+         const output = [];
+-        const [left, right] = this.address.split('::');
++        const [left, right] = this.addressMinusSuffix.split('::');
+         if (left.length) {
+             output.push(...helpers.simpleGroup(left));
+         }
+@@ -1000,4 +1018,3 @@
+     }
+ }
+ exports.Address6 = Address6;
+-//# sourceMappingURL=ipv6.js.map
+\ No newline at end of file
+diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
+index 1234567..abcdefg 100644
+--- a/deps/npm/node_modules/ip-address/package.json
++++ b/deps/npm/node_modules/ip-address/package.json
+@@ -7,7 +7,7 @@
+     "browser",
+     "validation"
+   ],
+-  "version": "10.1.0",
++  "version": "10.1.1",
+   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
+   "license": "MIT",
+   "main": "dist/ip-address.js",

diff --git a/nodejs22.spec b/nodejs22.spec
index ef2debb..e42c14a 100644
--- a/nodejs22.spec
+++ b/nodejs22.spec
@@ -165,6 +165,7 @@ Source101:      nodejs.srpm.macros
 %patchlist
 0001-Remove-unused-OpenSSL-config.patch
 0001-fips-disable-options.patch
+0002-CVE-2026-42338-ip-address-security-fix.patch
 
 %description
 Node.js is a platform built on Chrome's JavaScript runtime