Release date:
2026-10-15 12:15:45 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-32.el9.x86_64.rpm
sha:28ebd313b404d9948c3fe6c62b2ec98aac1c4c9d417d4459c5a5cdd3e3e86751
-
alt-nodejs16-nodejs-devel-16.20.2-32.el9.x86_64.rpm
sha:b12417678813101d9b349d799e86dc275468f05cd66f22b43e7c171a2a0c108f
-
alt-nodejs16-nodejs-docs-16.20.2-32.el9.noarch.rpm
sha:9c6576197fc71389751801fa9245690cf358c9c2865845ec693ca91466313a12
-
alt-nodejs16-npm-8.19.4-16.20.2.32.el9.x86_64.rpm
sha:057685290095e90782970ef781b5a3987f46b941277d7f75779d18429d1e57bd
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
