[CLSA-2026:1792714345] Fix of 7 CVEs

Type:

security

Severity:

Low

Release date:

2026-10-23 00:12:43 UTC

Description:

   * SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
     - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve
       and setLocalAddress hostnames
     - CVE-2026-105482
   * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
     - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
       hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
     - CVE-2026-106069
     - CVE-2026-106072
   * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
     - debian/patches/CVE-2026-105483.patch: regression tests only, the code
       fix is in CVE-2026-106069-CVE-2026-106072.patch
     - CVE-2026-105483
   * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
     - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
       in deps/brotli/c/dec/decode.c
     - CVE-2026-111497
   * SECURITY UPDATE: keep-alive socket reused with pending response data
     - debian/patches/CVE-2026-105481.patch: peek free sockets with
       hasPendingRead() before reuse in lib/_http_agent.js
     - CVE-2026-105481

CVEs fixed:

Updated packages:

alt-nodejs14-docs_14.21.3-35_amd64.deb
sha:cf91935b705bc897f3e3b0d7920693e7cd4726f7
alt-nodejs14-nodejs_14.21.3-35_amd64.deb
sha:383fa271e700a6e30ea610b0947f2fb54cf65602
alt-nodejs14-nodejs-devel_14.21.3-35_amd64.deb
sha:96b903af203fcb1f72f1d54bb71ba164b3e9085f
alt-nodejs14-npm_6.14.18-14.21.3-35_amd64.deb
sha:1d1f54be053725e63ca5ba23b8149aba4fce1415

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.