[CLSA-2026:1781274140] Fix CVE(s): CVE-2023-44487

Type:

security

Severity:

Important

Release date:

2026-06-12 14:22:49 UTC

Description:

   * SECURITY UPDATE: HTTP/2 Rapid Reset (CVE-2023-44487) — a peer can cause a
     denial of service by rapidly opening and cancelling HTTP/2 streams
     (HEADERS immediately followed by RST_STREAM) without bound; the flaw is in
     the bundled nghttp2 library (1.47.0)
     - debian/patches/CVE-2023-44487.patch: minimal backport of the upstream
       nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000
       rate=33/s) to deps/nghttp2; once the per-connection budget is exhausted
       a GOAWAY is sent. Cherry-pick of nghttp2 commit 72b4af6143 (shipped in
       1.57.0), no wholesale version bump (Node 16 went EOL before the upstream
       fix, so no fixed 16.x exists)
     - CVE-2023-44487

CVEs fixed:

CVE-2023-44487

Updated packages:

alt-nodejs16-docs_16.20.2-21_amd64.deb
sha:cbea2a761e0b3d8daa110ad48c19c4b3cd287cc2
alt-nodejs16-nodejs_16.20.2-21_amd64.deb
sha:20abf656e68c19dd28aa5f5fda5786308b8e037d
alt-nodejs16-nodejs-devel_16.20.2-21_amd64.deb
sha:a8f573d5c0789987091f65c7f8b58053d05f5909
alt-nodejs16-npm_8.19.4-16.20.2-21_amd64.deb
sha:2282ec76d7a0cb5870c2cf90bf2b4013068abb9d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.