[SECURITY] Fedora 35 Update: nodejs-16.11.1-1.fc35

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2021-9818cabe0d
2021-10-29 22:48:33.393275
--------------------------------------------------------------------------------

Name        : nodejs
Product     : Fedora 35
Version     : 16.11.1
Release     : 1.fc35
URL         : http://nodejs.org/
Summary     : JavaScript runtime
Description :
Node.js is a platform built on Chrome's JavaScript runtime
for easily building fast, scalable network applications.
Node.js uses an event-driven, non-blocking I/O model that
makes it lightweight and efficient, perfect for data-intensive
real-time applications that run across distributed devices.

--------------------------------------------------------------------------------
Update Information:

## 2021-10-12, Version 16.11.1 (Current), @danielleadams  This is a security
release.  ### Notable changes  * **CVE-2021-22959**: HTTP Request Smuggling due
to spaced in headers (Medium)   * The http parser accepts requests with a space
(SP) right after the header name before the colon. This can lead to HTTP Request
Smuggling (HRS). More details will be available at
[CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2...
after publication. * **CVE-2021-22960**: HTTP Request Smuggling when parsing the
body (Medium)   * The parse ignores chunk extensions when parsing the body of
chunked requests. This leads to HTTP Request Smuggling (HRS) under certain
conditions. More details will be available at
[CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2...
after publication.  ## 2021-10-08, Version 16.11.0 (Current), @danielleadams
### Notable Changes  * **crypto**   * update root certificates (Richard Lau)
[#40280](https://github.com/nodejs/node/pull/40280) * **deps**   * upgrade npm
to 8.0.0 (npm team) [#40369](https://github.com/nodejs/node/pull/40369)   *
update `nghttp2` to v1.45.1 (thunder-coding)
[#40206](https://github.com/nodejs/node/pull/40206)   * update V8 to 9.4.146.19
(Micha��l Zasso) [#40285](https://github.com/nodejs/node/pull/40285) * **tools**
* update certdata.txt (Richard Lau)
[#40280](https://github.com/nodejs/node/pull/40280)
--------------------------------------------------------------------------------
ChangeLog:

* Wed Oct 13 2021 Stephen Gallagher <sgallagh(a)redhat.com&gt; - 1:16.11.1-1
- Update to 16.11.1
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.m...
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.m...
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2014057 - CVE-2021-22959 llhttp: HTTP Request Smuggling due to spaced in
headers
        https://bugzilla.redhat.com/show_bug.cgi?id=2014057
  [ 2 ] Bug #2014059 - CVE-2021-22960 llhttp: HTTP Request Smuggling when parsing the
body
        https://bugzilla.redhat.com/show_bug.cgi?id=2014059
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2021-9818cabe0d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------