Release date:
2026-10-23 12:58:44 UTC
Description:
- ALTNJS-304: backport the Node.js October 2026 security fixes
- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106072, CVE-2026-106074, CVE-2026-111497
- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites
of the October fixes and live bugs in 19.9.0 in their own right
- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:
it has neither the ZIP container reader nor the Permission Model
- Behaviour change (upstream's): TLS now rejects a host that is an IP address
only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and
2130706433 no longer validate against any certificate
- Behaviour change (upstream's): net.connect() now type-checks options.host,
which 19.9.0 did not; a non-string host throws ERR_INVALID_ARG_TYPE
Updated packages:
-
alt-nodejs19-nodejs-19.9.0-10.el10.x86_64.rpm
sha:b907aa0022d393a5d037693b0847efff588dc97ea9e76f660e9b406fa054dcc6
-
alt-nodejs19-nodejs-devel-19.9.0-10.el10.x86_64.rpm
sha:ddfef61ae36dd8ba68236f3580c1b72c4eb3c496715483476f13e6bad9370b95
-
alt-nodejs19-nodejs-docs-19.9.0-10.el10.noarch.rpm
sha:ab69e8c6aee31eedaf2b062920a9deec3924abec8d3daab40e2a3f6047e8cb97
-
alt-nodejs19-npm-9.6.3-19.9.0.10.el10.x86_64.rpm
sha:88cf01b41cf954e5c6f8e7c7d0c61c201235c43a89b5b5bdfecbcb2e29d9e8d6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
