Release date:
2026-10-23 12:51:44 UTC
Description:
- ALTNJS-304: backport the Node.js October 2026 security fixes
- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106072, CVE-2026-106074, CVE-2026-111497
- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites
of the October fixes and live bugs in 19.9.0 in their own right
- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:
it has neither the ZIP container reader nor the Permission Model
- Behaviour change (upstream's): TLS now rejects a host that is an IP address
only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and
2130706433 no longer validate against any certificate
- Behaviour change (upstream's): net.connect() now type-checks options.host,
which 19.9.0 did not; a non-string host throws ERR_INVALID_ARG_TYPE
Updated packages:
-
alt-nodejs19-nodejs-19.9.0-10.el8.x86_64.rpm
sha:395f0ca68ed5e8fec8b5cef11ace1b09b08ec7fef8db496ca77c498498951e26
-
alt-nodejs19-nodejs-devel-19.9.0-10.el8.x86_64.rpm
sha:578cb8e9ad7c22668312ff0bcf9781ee0de62a69c48b49725ebdf934aaf5aad9
-
alt-nodejs19-nodejs-docs-19.9.0-10.el8.noarch.rpm
sha:84e7ecf436d597329a0b3bb0ba4fc2b7f36a5401884d7aa24a787db79eb1e0f9
-
alt-nodejs19-npm-9.6.3-19.9.0.10.el8.x86_64.rpm
sha:71b21f8d857b58ebb034534364820c039a828f701e7477557e127b6931ca4bce
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
