[CLSA-2026:1792719709] Fix of 7 CVEs

Type:

security

Severity:

Critical

Release date:

2026-10-23 01:42:05 UTC

Description:

   * SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
     - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve
       and setLocalAddress hostnames
     - CVE-2026-105482
   * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
     - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
       hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
     - CVE-2026-106069
     - CVE-2026-106072
   * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
     - debian/patches/CVE-2026-105483.patch: regression tests only, the code
       fix is in CVE-2026-106069-CVE-2026-106072.patch
     - CVE-2026-105483
   * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
     - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
       in deps/brotli/c/dec/decode.c
     - CVE-2026-111497
   * SECURITY UPDATE: keep-alive socket reused with pending response data
     - debian/patches/CVE-2026-105481.patch: peek free sockets with
       hasPendingRead() before reuse in lib/_http_agent.js
     - CVE-2026-105481

CVEs fixed:

Updated packages:

alt-nodejs14-docs_14.21.3-35_arm64.deb
sha:0bc8c167bb6e7f1f58393f182e9beb2f4c82ae98
alt-nodejs14-nodejs_14.21.3-35_arm64.deb
sha:b0a12c6dfa374d2003b7885ad5533aecdb8e8443
alt-nodejs14-nodejs-devel_14.21.3-35_arm64.deb
sha:24092026f98dcd9048f8b21d5eec266229cb6d68
alt-nodejs14-npm_6.14.18-14.21.3-35_arm64.deb
sha:436dee1660c952b4e9ba2fb666076551ec909033

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.