[CLSA-2026:1792720230] Fix of 7 CVEs

Type:

security

Severity:

Critical

Release date:

2026-10-23 01:50:46 UTC

Description:

   * SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
     - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve
       and setLocalAddress hostnames
     - CVE-2026-105482
   * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
     - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
       hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
     - CVE-2026-106069
     - CVE-2026-106072
   * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
     - debian/patches/CVE-2026-105483.patch: regression tests only, the code
       fix is in CVE-2026-106069-CVE-2026-106072.patch
     - CVE-2026-105483
   * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
     - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
       in deps/brotli/c/dec/decode.c
     - CVE-2026-111497
   * SECURITY UPDATE: keep-alive socket reused with pending response data
     - debian/patches/CVE-2026-105481.patch: peek free sockets with
       hasPendingRead() before reuse in lib/_http_agent.js
     - CVE-2026-105481

CVEs fixed:

Updated packages:

alt-nodejs14-docs_14.21.3-35_amd64.deb
sha:cbedcbc146341ef1597a9096569e4687fbf3fb5c
alt-nodejs14-nodejs_14.21.3-35_amd64.deb
sha:bc9eba998a3cecb242b83a80e7f7da2d1b6bfff6
alt-nodejs14-nodejs-devel_14.21.3-35_amd64.deb
sha:6afea7ab6689b6470a5f251e6c89114c7737cdc6
alt-nodejs14-npm_6.14.18-14.21.3-35_amd64.deb
sha:a8725e893edf41591994777406f432d35dd8f7b2

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.