Release date:
2026-10-16 07:16:26 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs18-nodejs-18.20.8-25.el8.x86_64.rpm
sha:f27b0fdb0ab00fb98b786d20cb974dad12ddf23de70869f05aa223a9a9da1b65
-
alt-nodejs18-nodejs-devel-18.20.8-25.el8.x86_64.rpm
sha:1f4f8f32b038c693ff9f1d0b51fc5e68beb0eba2f0a8f00d2d704c9272c0ec17
-
alt-nodejs18-nodejs-docs-18.20.8-25.el8.noarch.rpm
sha:5b5a1d401d17f6e7e5b1d4bc2e81c86fa1350ba328d74076edc8c7dd374f6968
-
alt-nodejs18-npm-10.8.2-18.20.8.25.el8.x86_64.rpm
sha:d482a862162857fd5fdf09b0da1ce1292b0731af598ff799bef51975ef61642a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
