Release date:
2026-10-23 00:49:45 UTC
Description:
* SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
- debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns lookup,
resolve and setLocalAddress hostnames
- CVE-2026-105482
* SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
- debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
- CVE-2026-106069
- CVE-2026-106072
* SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
- debian/patches/CVE-2026-105483.patch: regression tests only, the code
fix is in CVE-2026-106069-CVE-2026-106072.patch
- CVE-2026-105483
* SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
- debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
in deps/brotli/c/dec/decode.c
- CVE-2026-111497
* SECURITY UPDATE: keep-alive socket reused with pending response data
- debian/patches/CVE-2026-105481.patch: peek free sockets with
hasPendingRead() before reuse in lib/_http_agent.js
- CVE-2026-105481
Updated packages:
-
alt-nodejs16-docs_16.20.2-32_amd64.deb
sha:2144dcadfa4a06ce9b13e13083f561c96500b465
-
alt-nodejs16-nodejs_16.20.2-32_amd64.deb
sha:1e220632189fe721653f7e58c9b395b14c0f20b1
-
alt-nodejs16-nodejs-devel_16.20.2-32_amd64.deb
sha:e6b4a68e361e811306f1217eec91b1431d77f92e
-
alt-nodejs16-npm_8.19.4-16.20.2-32_amd64.deb
sha:415c7193976c6653a78e3c4ad3c2985d8e7034c9
-
alt-nodejs16-docs_16.20.2-32_arm64.deb
sha:c02bc11965524896f1a1d4e4f44ac1f651fe1498
-
alt-nodejs16-nodejs_16.20.2-32_arm64.deb
sha:5f4be0ad61a1cb7bf69c30740a10666000c7ca21
-
alt-nodejs16-nodejs-devel_16.20.2-32_arm64.deb
sha:38721d2f7164e7cbf7d3912d58ad70618cfa7706
-
alt-nodejs16-npm_8.19.4-16.20.2-32_arm64.deb
sha:a2c70102603d8ff7278ef10a131c6807c5d0707e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
