Node.js 24.21.0 Linux x64: CVE-2026-102010 PBDS build-provenance applicability question #5179

Node.js Version

Not installed (removed from production runtime image)

NPM Version

Use the npm version from the Docker image, not your Windows installation

Operating System

Debian GNU/Linux 13 (Trixie), linux/amd64

Subsystem

Other

Description

Hello Node.js maintainers,

Could you clarify the applicability of the public GCC advisory CVE-2026-102010 to the distributed Node.js 24.21.0 Linux x64 runtime and its statically linked dependencies?

The installed node executable has SHA-256:
7fde7b8afa198da66257f42ee2001d874c7355631e6d1579a5fb5ef1f246df4c

It came from the official Node Docker base pinned at sha256:173f125896c3b47ddf056734c7ea789d04595a6a08769a8f78e0df642781fb66 (Debian Trixie, linux/amd64). A scanner reports GCC-source-package associations at 14.2.0-19; that does not establish affected code in Node itself.

The upstream fix concerns the header-defined __gnu_pbds::priority_queue<..., binary_heap_tag>::erase_if implementation:
gcc-mirror/gcc@aaa8351

1. Is the affected template instantiated in this distributed runtime or any statically linked dependency?
2. If present, can it be reached through supported Node APIs during normal or attacker-influenced input processing?
3. Is a supported corrected binary available, or can you point to build/header provenance or a release-specific applicability statement that establishes exclusion or inclusion of the fix?

We have no reproducer, confirmed vulnerable call path or new vulnerability to disclose. This is a build-provenance/support question about a public advisory, not a claim that Node.js is affected. We understand that replacing a shared libstdc++ package or finding no PBDS symbols does not settle compiled-template applicability. If this requires private triage, please direct us to the appropriate process.

Thank you.

Minimal Reproduction

No response

Output

No response

Before You Submit

• I have looked for issues that already exist before submitting this
• My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask