Release date:
2026-10-16 06:49:06 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs18-nodejs-18.20.8-25.el9.x86_64.rpm
sha:00e422a68d44f0d9c502aeef307f39304cef1e79b503dea0aa815ea43c40beed
-
alt-nodejs18-nodejs-devel-18.20.8-25.el9.x86_64.rpm
sha:42187a4363922fe8718299bc732e273c3a2f1cd802dd72f62cdf4dd13799b33c
-
alt-nodejs18-nodejs-docs-18.20.8-25.el9.noarch.rpm
sha:b52f09a561b8dfb1a5f05d839c0bcff53036b5fc64a9338e4b57a7ee3ff0cc91
-
alt-nodejs18-npm-10.8.2-18.20.8.25.el9.x86_64.rpm
sha:2c5f982ca7c7eb5eb495a7d9ae7c0f12f1468688b80e63bd48b89c58d1c58a53
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
