Release date:
2026-10-15 12:21:59 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-32.el7.x86_64.rpm
sha:41832d40fd57ac47450c2e024f8c2a0d6a094378171e5400ac2f8eab82935641
-
alt-nodejs16-nodejs-devel-16.20.2-32.el7.x86_64.rpm
sha:abb5863536357cd7cf5aee3f8e7b493425ba4e359f03dfcef640c08c6ef29449
-
alt-nodejs16-nodejs-docs-16.20.2-32.el7.noarch.rpm
sha:a488ce2ca998d40a7726ed5f95a76854f6a262f547436931bd1685a85e6f45f7
-
alt-nodejs16-npm-8.19.4-16.20.2.32.el7.x86_64.rpm
sha:42783694d4da4519f2d2c0ba4c37f99b12de2ea75345e68f2a210fe49b203ad4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
