Release date:
2026-10-15 12:40:13 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-32.el10.x86_64.rpm
sha:fc04e79b2a03b857e544c43e08c2e7ac6d3c7b3b7006e3fd9480facb54047646
-
alt-nodejs16-nodejs-devel-16.20.2-32.el10.x86_64.rpm
sha:61cb258f6e1cd4300ea47a747aaf75a06e46563a1bab6098a06f93d7f8767af0
-
alt-nodejs16-nodejs-docs-16.20.2-32.el10.noarch.rpm
sha:0a8b883d1a03dc5ab10eafa845b58664cdd0ae7793de8733d80d231f742b7f38
-
alt-nodejs16-npm-8.19.4-16.20.2.32.el10.x86_64.rpm
sha:7e3d7c859c23e0edd9290a9c494ee1106dd9487450fdc7539f1c07bebe56c000
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
