Release date:
2026-10-23 02:23:32 UTC
Description:
* SECURITY UPDATE: fs permission model granted paths shorter than a
wildcard grant's prefix
- debian/patches/CVE-2026-106071.patch: bound the prefix-matching loop in
src/permission/fs_permission.h by the prefix length rather than the path
length, so --allow-fs-read=/tmp/test* no longer also grants /tmp/tes.
Upstream scopes this to 26.x, but it reproduces on 24.x including
24.22.1, so the update to 24.22.1 does not cover it
- CVE-2026-106071
Updated packages:
-
alt-nodejs24-docs_24.22.1-2_amd64.deb
sha:fb1a6f4c2ad442524c530df55541202ab19ccc18
-
alt-nodejs24-nodejs_24.22.1-2_amd64.deb
sha:a9c957f25a82b9c75ab3506aa214be963991cab9
-
alt-nodejs24-nodejs-devel_24.22.1-2_amd64.deb
sha:e9bc327caa69aa67bc15e0e0d1d8e37ab2d85ec9
-
alt-nodejs24-npm_11.19.1-24.22.1.2_amd64.deb
sha:1411d4cfb7bb165d0056cc3ab16bb25eb7b564fb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
