Release date:
2026-10-23 09:19:01 UTC
Description:
- CVE-2026-106071: the fs permission radix tree matched a wildcard node
against a path shorter than the node's prefix, so a grant such as
--allow-fs-read=/tmp/test* also granted /tmp/tes and /tmp/te. The prefix
loop is now bounded by the prefix length instead of the path length.
Upstream scopes this CVE to 26.x, but it reproduces on 24.x including
24.22.1, so the tarball update to 24.22.1 does not cover it
Updated packages:
-
alt-nodejs24-nodejs-24.22.1-2.el10.x86_64.rpm
sha:b9161da93b73e86f22f8eccb54b11b968f343f6938aaafb1287eaea73828a536
-
alt-nodejs24-nodejs-devel-24.22.1-2.el10.x86_64.rpm
sha:104e800875dd9b52adeaf22b0c735c2089c56808a2bd44726c635ffdcd1e7bd9
-
alt-nodejs24-nodejs-docs-24.22.1-2.el10.noarch.rpm
sha:29d0feab58f9008c91f95315f7382f88aa27978ea0368f88c1ca035e1ce80fa9
-
alt-nodejs24-npm-11.19.1-24.22.1.2.el10.x86_64.rpm
sha:6548887caf6d853af71525e723f793d71a2cc789ff063fb5ddae475e0ac8ba88
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
