Release date:
2026-10-23 09:16:01 UTC
Description:
- CVE-2026-106071: the fs permission radix tree matched a wildcard node
against a path shorter than the node's prefix, so a grant such as
--allow-fs-read=/tmp/test* also granted /tmp/tes and /tmp/te. The prefix
loop is now bounded by the prefix length instead of the path length.
Upstream scopes this CVE to 26.x, but it reproduces on 24.x including
24.22.1, so the tarball update to 24.22.1 does not cover it
Updated packages:
-
alt-nodejs24-nodejs-24.22.1-2.el8.x86_64.rpm
sha:a9f1128f929b5aac28386e4f536764dde0050d8bc086aa7d0f13809446a08dc5
-
alt-nodejs24-nodejs-devel-24.22.1-2.el8.x86_64.rpm
sha:294857cf3e5d58bece2dc1d6571fcfeb8a3f4b02fbc22165e195ed0b6937e129
-
alt-nodejs24-nodejs-docs-24.22.1-2.el8.noarch.rpm
sha:f827851449535101ba31958dff0abfa2e1859b3bb4fac5a53f4ae65ee0a78dae
-
alt-nodejs24-npm-11.19.1-24.22.1.2.el8.x86_64.rpm
sha:c84f5d29c7e04241b14c770f36c29e0073bf541c1b6c3529e9f7409ed3d0987b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
