Release date:
2026-10-23 12:46:45 UTC
Description:
- ALTNJS-304: backport the Node.js October 2026 security fixes
- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106072, CVE-2026-106074, CVE-2026-111497
- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites
of the October fixes and live bugs in 19.9.0 in their own right
- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:
it has neither the ZIP container reader nor the Permission Model
- Behaviour change (upstream's): TLS now rejects a host that is an IP address
only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and
2130706433 no longer validate against any certificate
- Behaviour change (upstream's): net.connect() now type-checks options.host,
which 19.9.0 did not; a non-string host throws ERR_INVALID_ARG_TYPE
Updated packages:
-
alt-nodejs19-nodejs-19.9.0-10.el9.x86_64.rpm
sha:e84cf06ea3a6100f2a0052caa0e32509dd0fad29f7cde5a57a2bb1c25b36bcbd
-
alt-nodejs19-nodejs-devel-19.9.0-10.el9.x86_64.rpm
sha:1178ff566b569c1df7590e927bfee1ee9a34bf339efb3497e40d3835e783dcd9
-
alt-nodejs19-nodejs-docs-19.9.0-10.el9.noarch.rpm
sha:e7605c3dd92b0404dd0c5b3d5a61667ac771ed774fe86b47fae782bf39d7518e
-
alt-nodejs19-npm-9.6.3-19.9.0.10.el9.x86_64.rpm
sha:5fa75c58fec9ec640dff946e1f777fc7e71d0eca91a73df8632667fd10f73be2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
