[CLSA-2026:1791891680] nodejs: Fix of CVE-2026-9496
Type:
security
Severity:
Important
Release date:
2026-10-13 11:41:31 UTC
Description:
- CVE-2026-9496: strip the committish in addGitSha() of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU
CVEs fixed:
Updated packages:
  • nodejs-16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:20e22bc14ac786e7e89e6e46e3d418a4fa5fcd192607a7d1f25d1a6875ea9294
  • nodejs-16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:7ff1842be2645119876716351d66d0a3a547597c4813aae59b4af9f75ba7005a
  • nodejs-16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:42bac27060c61839810dffa37423bfbb3c7079e66ab456be862b41ff88939ec9
  • nodejs-devel-16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:d4e686d851f4bfb85a5af85e01e91dafe1b3560ed21db0525ea36eac490a8bb0
  • nodejs-devel-16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:df957538432ea714cec672d3b94d5f258b8051fb17a6820056493c1743ed063e
  • nodejs-devel-16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:64587fef44c6038b756f7cdad93f63ecd456a7126b32fec35dd655a70ac075cd
  • nodejs-docs-16.20.2-8.el9_8.tuxcare.els22.noarch.rpm
    sha:0e960c427893ccadf0379ae2c27303ff48832c00464f0ae85cdb0f2dd64b3cdd
  • nodejs-full-i18n-16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:deaf3dc5e83bafcf5968d3f61ea862f6a543e3f5bab93a5b4cb2212fac5cc8e2
  • nodejs-full-i18n-16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:eb7580949dba9eef49a5c45b65163785e345e7ef75e9d10aa75a371524089047
  • nodejs-full-i18n-16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:10f0c44db71ec531d4a7b64f651d6bba0f31b0b44a74fa846df058600bc43718
  • nodejs-libs-16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:7f4d52e477ed6706e250a29b767aabac1ca30d30b6b531757835e74068483aaf
  • nodejs-libs-16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:3c9abf7db210d9f3282ca0bd7c49336ebca850345efb9b1594970554801e2170
  • nodejs-libs-16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:875e36bba694fa40b042a316edb06d4da371710eef53d4718246097de91cd91c
  • npm-8.19.4_1.16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:86a1836c92cef882892b1bd1447220966b8c1d951fe1cb9141a60ec4b8ec544a
  • npm-8.19.4_1.16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:c55ae851ebeb20dfd4508318bb284218675abc9efb8bf1083d9f89f06a605119
  • npm-8.19.4_1.16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:65c4c7ff2f5b608332c44e20415bd92ef5a90a9551d05cf54dae29cad8a52c18
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els22.aarch64.rpm
    sha:8012ee003e633d517f32c10c8c9a5fd7958f679ff596072e3a0c9c69d38c3927
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els22.i686.rpm
    sha:d94da3549c58e2143a28a0977825c02ad0fadb753247a613c648166bbaa98371
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els22.x86_64.rpm
    sha:35bb63626bdaf45b0f9a7e5784c03ae8a8715de2a0391202fa27241805c05fa8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.