Release date:
2026-10-15 12:29:35 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-32.el8.x86_64.rpm
sha:ce5cf42bca847ef0ee88f4876929af552692096ee866f0173f67f289552037fa
-
alt-nodejs16-nodejs-devel-16.20.2-32.el8.x86_64.rpm
sha:7e88953b652e59939223aaa60f7f817040d0fcd001bb49d145c977a9a002aec7
-
alt-nodejs16-nodejs-docs-16.20.2-32.el8.noarch.rpm
sha:420548294db45dac06ba3b1da10a5de40ed836a485fa8fa671ac23b878795fe3
-
alt-nodejs16-npm-8.19.4-16.20.2.32.el8.x86_64.rpm
sha:bbd133444a622eba253e68446495766e14c209e1c864104c5c00658d372fc8c5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
