Release date:
2026-06-12 14:17:20 UTC
Description:
* SECURITY UPDATE: HTTP/2 Rapid Reset (CVE-2023-44487) — a peer can cause a
denial of service by rapidly opening and cancelling HTTP/2 streams
(HEADERS immediately followed by RST_STREAM) without bound; the flaw is in
the bundled nghttp2 library (1.47.0)
- debian/patches/CVE-2023-44487.patch: minimal backport of the upstream
nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000
rate=33/s) to deps/nghttp2; once the per-connection budget is exhausted
a GOAWAY is sent. Cherry-pick of nghttp2 commit 72b4af6143 (shipped in
1.57.0), no wholesale version bump (Node 16 went EOL before the upstream
fix, so no fixed 16.x exists)
- CVE-2023-44487
Updated packages:
-
alt-nodejs16-docs_16.20.2-21_amd64.deb
sha:24acec7fb8d9563a35fba66546df54acea128464
-
alt-nodejs16-nodejs_16.20.2-21_amd64.deb
sha:d181f44f61e881dddd49510415dce1450ab00734
-
alt-nodejs16-nodejs-devel_16.20.2-21_amd64.deb
sha:018d394dcdc1b8aa073a5bb2fe4c1bdf70adc995
-
alt-nodejs16-npm_8.19.4-16.20.2-21_amd64.deb
sha:048b0d14ff8095aefb6286b0870ad7262c33b7ba
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
