Release date:
2026-10-23 00:52:24 UTC
Description:
* SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated
- debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns lookup,
resolve and setLocalAddress hostnames
- CVE-2026-105482
* SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN
- debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject
hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity
- CVE-2026-106069
- CVE-2026-106072
* SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN
- debian/patches/CVE-2026-105483.patch: regression tests only, the code
fix is in CVE-2026-106069-CVE-2026-106072.patch
- CVE-2026-105483
* SECURITY UPDATE: out-of-bounds write in bundled brotli decoder
- debian/patches/CVE-2026-111497.patch: fail on an invalid block switch
in deps/brotli/c/dec/decode.c
- CVE-2026-111497
* SECURITY UPDATE: keep-alive socket reused with pending response data
- debian/patches/CVE-2026-105481.patch: peek free sockets with
hasPendingRead() before reuse in lib/_http_agent.js
- CVE-2026-105481
Updated packages:
-
alt-nodejs16-docs_16.20.2-32_amd64.deb
sha:2144dcadfa4a06ce9b13e13083f561c96500b465
-
alt-nodejs16-nodejs_16.20.2-32_amd64.deb
sha:258d37e4cadeb988b1d49f1daa4154db1c5be88d
-
alt-nodejs16-nodejs-devel_16.20.2-32_amd64.deb
sha:236eb88a54855e6f4be9f72368647bb8a56e3837
-
alt-nodejs16-npm_8.19.4-16.20.2-32_amd64.deb
sha:c109336b18bbd3932438e9c6d01d1e7a734831f5
-
alt-nodejs16-docs_16.20.2-32_arm64.deb
sha:c02bc11965524896f1a1d4e4f44ac1f651fe1498
-
alt-nodejs16-nodejs_16.20.2-32_arm64.deb
sha:a9f104cd0eee567879f3803da683a835a5af2fef
-
alt-nodejs16-nodejs-devel_16.20.2-32_arm64.deb
sha:10fc3da5409d71292b5363683fb41b3b15fe706c
-
alt-nodejs16-npm_8.19.4-16.20.2-32_arm64.deb
sha:ce4c6039d444839f197b6552ff1b6e98e025d4a2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
