Release date:
2026-10-15 11:59:39 UTC
Description:
* SECURITY UPDATE: regular-expression denial of service in the bundled npm
dependency pacote. addGitSha() stripped an existing committish from a git
dependency spec with `spec.rawSpec.replace(/#.*$/, '')`, which backtracks
quadratically on a rawSpec carrying many '#' characters followed by a
newline, so resolving such a spec burned CPU for seconds instead of
microseconds (CVE-2026-9496)
- debian/patches/CVE-2026-9496.patch: replace the regular expression in
deps/npm/node_modules/pacote/lib/util/add-git-sha.js with an
indexOf/slice committish strip, which is linear in the length of the
spec. Upstream's companion test change is omitted because npm publishes
pacote without its test directory, so no test file ships here
- CVE-2026-9496
Updated packages:
-
alt-nodejs18-docs_18.20.8-25_amd64.deb
sha:83813f896cdbc2ee4ae1d03ca83c304b0ba96c0f
-
alt-nodejs18-nodejs_18.20.8-25_amd64.deb
sha:ebb703831653a24e265cfa057f9816c4930bd46f
-
alt-nodejs18-nodejs-devel_18.20.8-25_amd64.deb
sha:7253529ce497fa2dcbd8340beea6230ed615395d
-
alt-nodejs18-npm_10.8.2-18.20.8.25_amd64.deb
sha:829e955190a94b476684cda4ea06ce49418337b9
-
alt-nodejs18-docs_18.20.8-25_arm64.deb
sha:30fe321ae182968bbfd9f7e984dac3d62c457b9b
-
alt-nodejs18-nodejs_18.20.8-25_arm64.deb
sha:2eba4d05fe13b4c72523553f6b9b2431b54238fc
-
alt-nodejs18-nodejs-devel_18.20.8-25_arm64.deb
sha:464c374044f7b23b46c326aa66a44fb0b11403ee
-
alt-nodejs18-npm_10.8.2-18.20.8.25_arm64.deb
sha:63d22b00cca0840aa285514cf7e0710a4686e0e3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
