Release date:
2026-10-23 02:29:38 UTC
Description:
* SECURITY UPDATE: fs permission model granted paths shorter than a
wildcard grant's prefix
- debian/patches/CVE-2026-106071.patch: bound the prefix-matching loop in
src/permission/fs_permission.h by the prefix length rather than the path
length, so --allow-fs-read=/tmp/test* no longer also grants /tmp/tes.
Upstream scopes this to 26.x, but it reproduces on 24.x including
24.22.1, so the update to 24.22.1 does not cover it
- CVE-2026-106071
Updated packages:
-
alt-nodejs24-docs_24.22.1-2_amd64.deb
sha:fb1a6f4c2ad442524c530df55541202ab19ccc18
-
alt-nodejs24-nodejs_24.22.1-2_amd64.deb
sha:fcff57159973a10ac7d0359370391eb62c48d94a
-
alt-nodejs24-nodejs-devel_24.22.1-2_amd64.deb
sha:d6a36aec6ac8bee2d31d9e6d086b3495f26dc9ad
-
alt-nodejs24-npm_11.19.1-24.22.1.2_amd64.deb
sha:1411d4cfb7bb165d0056cc3ab16bb25eb7b564fb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
