[CLSA-2026:1792715806] Fix of 8 CVEs

Type:

security

Severity:

Low

Release date:

2026-10-23 00:37:02 UTC

Description:

   * SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
     - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve
       and setLocalAddress hostnames
     - CVE-2026-105482
   * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
     - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
       hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
     - CVE-2026-106069
     - CVE-2026-106072
   * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
     - debian/patches/CVE-2026-105483.patch: regression tests only, the code
       fix is in CVE-2026-106069-CVE-2026-106072.patch
     - CVE-2026-105483
   * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
     - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
       in deps/brotli/c/dec/decode.c
     - CVE-2026-111497
   * SECURITY UPDATE: keep-alive socket reused with pending response data
     - debian/patches/CVE-2026-105481.patch: peek free sockets with
       hasPendingRead() before reuse in lib/_http_agent.js
     - CVE-2026-105481
   * SECURITY UPDATE: random caches replayed from a startup snapshot
     - debian/patches/CVE-2026-106074.patch: reset randomInt() and
       randomUUID() caches across --build-snapshot snapshots
     - CVE-2026-106074

CVEs fixed:

Updated packages:

alt-nodejs18-docs_18.20.8-26_amd64.deb
sha:14362cc1f3da1ec67f30bbb3716a611d89299017
alt-nodejs18-nodejs_18.20.8-26_amd64.deb
sha:30a98917f20170807128912bf1512cb5680cec2c
alt-nodejs18-nodejs-devel_18.20.8-26_amd64.deb
sha:1f37dc69f23745f20816be25da4e874f937fe612
alt-nodejs18-npm_10.8.2-18.20.8.26_amd64.deb
sha:8ff9431824e6eaaf16e5e6d3d8d905eb0abe88cb

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.