Release date:
2026-10-23 01:44:45 UTC
Description:
* SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
- debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve
and setLocalAddress hostnames
- CVE-2026-105482
* SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
- debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
- CVE-2026-106069
- CVE-2026-106072
* SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
- debian/patches/CVE-2026-105483.patch: regression tests only, the code
fix is in CVE-2026-106069-CVE-2026-106072.patch
- CVE-2026-105483
* SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
- debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
in deps/brotli/c/dec/decode.c
- CVE-2026-111497
* SECURITY UPDATE: keep-alive socket reused with pending response data
- debian/patches/CVE-2026-105481.patch: peek free sockets with
hasPendingRead() before reuse in lib/_http_agent.js
- CVE-2026-105481
Updated packages:
-
alt-nodejs14-docs_14.21.3-35_amd64.deb
sha:cbedcbc146341ef1597a9096569e4687fbf3fb5c
-
alt-nodejs14-nodejs_14.21.3-35_amd64.deb
sha:8de697d86ffabdcc4826e5b757e0def1701d876e
-
alt-nodejs14-nodejs-devel_14.21.3-35_amd64.deb
sha:03784fed46dd74202720699d0a549f6e6d22f91b
-
alt-nodejs14-npm_6.14.18-14.21.3-35_amd64.deb
sha:f52782c81dae9f6b1669298925cb9597a206cff1
-
alt-nodejs14-docs_14.21.3-35_arm64.deb
sha:0bc8c167bb6e7f1f58393f182e9beb2f4c82ae98
-
alt-nodejs14-nodejs_14.21.3-35_arm64.deb
sha:cf86f07f64b2e2cf23d69466f8019ba6117ec1b5
-
alt-nodejs14-nodejs-devel_14.21.3-35_arm64.deb
sha:789ae1a4ece3ae65f52cf34414da8fce7178d3de
-
alt-nodejs14-npm_6.14.18-14.21.3-35_arm64.deb
sha:3a0b6af4f88025ed4e646a07b376fdceb3abd3ee
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
