Release date:
2026-10-23 09:22:04 UTC
Description:
- CVE-2026-106071: the fs permission radix tree matched a wildcard node
against a path shorter than the node's prefix, so a grant such as
--allow-fs-read=/tmp/test* also granted /tmp/tes and /tmp/te. The prefix
loop is now bounded by the prefix length instead of the path length.
Upstream scopes this CVE to 26.x, but it reproduces on 24.x including
24.22.1, so the tarball update to 24.22.1 does not cover it
Updated packages:
-
alt-nodejs24-nodejs-24.22.1-2.el9.x86_64.rpm
sha:701dfc891667da3ce743585a1b593d938fcc6781a448bb1faf4bb09d684cf6af
-
alt-nodejs24-nodejs-devel-24.22.1-2.el9.x86_64.rpm
sha:4872c94bfc902775048afcd9fabb92bd5a4ca2bc713a4e984fb72ac458610d6f
-
alt-nodejs24-nodejs-docs-24.22.1-2.el9.noarch.rpm
sha:379bae337203581421ea76a2661c00363db5b7a89c63a76707c3f580860f5de2
-
alt-nodejs24-npm-11.19.1-24.22.1.2.el9.x86_64.rpm
sha:05907b8984880d14d41ed63707d823b9d661a03a5ae98559fd655ffeab4cd348
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
