Release date:
2026-05-28 07:43:27 UTC
Description:
* SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
the internal string table, letting attacker-controlled JSON.parse input
degrade performance in a local PoC against V8 10.2.154.26
- debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
value stored in a Name's hash_field via a 3-round xorshift-multiply
with compile-time constants (no upstream Node.js 18 fix exists — 18.x
went EOL before disclosure; this is an adapted reduced port, no
rapidhash / HashSeed-view refactor)
- CVE-2026-21717
Updated packages:
-
alt-nodejs18-docs_18.20.8-13_amd64.deb
sha:eba669d0584611eb4de287b3b2e84fc34e96e596
-
alt-nodejs18-nodejs_18.20.8-13_amd64.deb
sha:28a2f6c278ea92f144e162a094dda14452b2d443
-
alt-nodejs18-nodejs-devel_18.20.8-13_amd64.deb
sha:ecbd768bfaa19efb2b36960343d930022300190d
-
alt-nodejs18-npm_10.8.2-18.20.8.13_amd64.deb
sha:184abe771a41c08621943e6cba210a6aceaa7826
-
alt-nodejs18-docs_18.20.8-13_arm64.deb
sha:a585955d7098c34c903b8a2fe4311e3fb0be5398
-
alt-nodejs18-nodejs_18.20.8-13_arm64.deb
sha:a079cf64e48875da9bee2ca3b82bcb4ccc747108
-
alt-nodejs18-nodejs-devel_18.20.8-13_arm64.deb
sha:64061f3ccddb394c67834ea483e028a9e0c0f92a
-
alt-nodejs18-npm_10.8.2-18.20.8.13_arm64.deb
sha:1a3f06a65b4f0164c7910ab995b5ff75aa90d713
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
