Release date:
2026-05-27 14:31:13 UTC
Description:
* SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
the internal string table, letting attacker-controlled JSON.parse input
degrade performance in a local PoC against V8 8.4.371.23
- debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
value stored in a Name's hash_field via a 3-round xorshift-multiply
with compile-time constants (no upstream V8 8.4 backport exists; this
is an adapted reduced port — no rapidhash/HashSeed-view refactor)
- CVE-2026-21717
Updated packages:
-
alt-nodejs14-docs_14.21.3-23_amd64.deb
sha:a2b01a9c715d221c1e4d0200d09c127f72ba3d92
-
alt-nodejs14-nodejs_14.21.3-23_amd64.deb
sha:9b8d9d73b1818a48cfd0c272ab6b46eb5f1549ff
-
alt-nodejs14-nodejs-devel_14.21.3-23_amd64.deb
sha:6f80b4f7cf4b850f500ae3f40822a7e393c32001
-
alt-nodejs14-npm_6.14.18-14.21.3-23_amd64.deb
sha:3647add104e2555faed94958ac26f7670c0ebf5c
-
alt-nodejs14-docs_14.21.3-23_arm64.deb
sha:37de7b8680d066b6b28e2e85438f5a957d29e119
-
alt-nodejs14-nodejs_14.21.3-23_arm64.deb
sha:c9cdf6c4b77c8888518c01c2cf1caa6934be8fb0
-
alt-nodejs14-nodejs-devel_14.21.3-23_arm64.deb
sha:cad7e2e3beb828138a6a428f8cb45e1680cf22f8
-
alt-nodejs14-npm_6.14.18-14.21.3-23_arm64.deb
sha:ebc904da6384d86684a1740ebe8d98a853b18112
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
