[CLSA-2026:1792717808] Fix of 7 CVEs

Type:

security

Severity:

Critical

Release date:

2026-10-23 01:10:25 UTC

Description:

   * SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
     - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns lookup,
       resolve and setLocalAddress hostnames
     - CVE-2026-105482
   * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
     - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
       hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
     - CVE-2026-106069
     - CVE-2026-106072
   * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
     - debian/patches/CVE-2026-105483.patch: regression tests only, the code
       fix is in CVE-2026-106069-CVE-2026-106072.patch
     - CVE-2026-105483
   * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
     - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
       in deps/brotli/c/dec/decode.c
     - CVE-2026-111497
   * SECURITY UPDATE: keep-alive socket reused with pending response data
     - debian/patches/CVE-2026-105481.patch: peek free sockets with
       hasPendingRead() before reuse in lib/_http_agent.js
     - CVE-2026-105481

CVEs fixed:

Updated packages:

alt-nodejs16-docs_16.20.2-32_amd64.deb
sha:2144dcadfa4a06ce9b13e13083f561c96500b465
alt-nodejs16-nodejs_16.20.2-32_amd64.deb
sha:968e62708df0f9bd9a9737a8dc2e7ad9140fccd5
alt-nodejs16-nodejs-devel_16.20.2-32_amd64.deb
sha:b4880a41f2cea5b41a2db7c040bf1c7535bf7e30
alt-nodejs16-npm_8.19.4-16.20.2-32_amd64.deb
sha:94e568e52a547dbb1840ae85d4fbda451c160b61

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.