Release date:
2026-10-16 07:09:07 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs18-nodejs-18.20.8-25.el10.x86_64.rpm
sha:bd9217531e7145867552d6c25f03ed43d150e1c829d15f3339c4a065970a763d
-
alt-nodejs18-nodejs-devel-18.20.8-25.el10.x86_64.rpm
sha:1a2c430751ca0596a7e7f8d70ea0ec60016a0aa8ed220160ac58135aa90cc35c
-
alt-nodejs18-nodejs-docs-18.20.8-25.el10.noarch.rpm
sha:d6b4de2919a9bfb72f78dbe5a2c059cbcfbf41317626467340d6a46e1d4e89bf
-
alt-nodejs18-npm-10.8.2-18.20.8.25.el10.x86_64.rpm
sha:6920b479a4ec870d238f22a88a7b3de5daad2e5a13f48e41803dfd13d0556ac4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
