Release date:
2026-10-23 12:04:04 UTC
Description:
- ALTNJS-304: backport the Node.js October 2026 security fixes
- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106072, CVE-2026-106074, CVE-2026-111497
- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites
of the October fixes and live bugs in 19.9.0 in their own right
- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:
it has neither the ZIP container reader nor the Permission Model
- Behaviour change (upstream's): TLS now rejects a host that is an IP address
only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and
2130706433 no longer validate against any certificate
- Behaviour change (upstream's): net.connect() now type-checks options.host,
which 19.9.0 did not; a non-string host throws ERR_INVALID_ARG_TYPE
Updated packages:
-
alt-nodejs19-nodejs-19.9.0-10.el7.x86_64.rpm
sha:21f69708a32799bb042417167c26c6681e4beb8c996e3aadc323df80e966bd12
-
alt-nodejs19-nodejs-devel-19.9.0-10.el7.x86_64.rpm
sha:0c6d22c007efb86fc1215aa707340b146d1c7fa43a48f40b6ad5a8ac7babdcdd
-
alt-nodejs19-nodejs-docs-19.9.0-10.el7.noarch.rpm
sha:7e760e83490890e7c1a1f756ea3397e27545c64ce3d37c42178d7a52556b7228
-
alt-nodejs19-npm-9.6.3-19.9.0.10.el7.x86_64.rpm
sha:dd629168246ed952093e3e0db5d6c6ba8d65f40636ae46b4dd53d60d64a0827a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
