Release date:
2026-05-27 14:51:34 UTC
Description:
* SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
the internal string table, letting attacker-controlled JSON.parse input
degrade performance in a local PoC against V8 8.4.371.23
- debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
value stored in a Name's hash_field via a 3-round xorshift-multiply
with compile-time constants (no upstream V8 8.4 backport exists; this
is an adapted reduced port — no rapidhash/HashSeed-view refactor)
- CVE-2026-21717
Updated packages:
-
alt-nodejs14-docs_14.21.3-23_amd64.deb
sha:a2b01a9c715d221c1e4d0200d09c127f72ba3d92
-
alt-nodejs14-nodejs_14.21.3-23_amd64.deb
sha:6a9fa1bff084fe90e0cb427ac3e604a7b6bc05ae
-
alt-nodejs14-nodejs-devel_14.21.3-23_amd64.deb
sha:fc20b07fe749c384d165fb13e7a97125a872db8e
-
alt-nodejs14-npm_6.14.18-14.21.3-23_amd64.deb
sha:11008b9c7cb9c2f7e4eef30b77071cfb4dfd12b9
-
alt-nodejs14-docs_14.21.3-23_arm64.deb
sha:37de7b8680d066b6b28e2e85438f5a957d29e119
-
alt-nodejs14-nodejs_14.21.3-23_arm64.deb
sha:8cb71629add3b72f4075a9c39de91eef48d01c81
-
alt-nodejs14-nodejs-devel_14.21.3-23_arm64.deb
sha:c9226a877b5f47cc3f5bae751aa3ee13682b8925
-
alt-nodejs14-npm_6.14.18-14.21.3-23_arm64.deb
sha:5dd087606d22018f998a2ac32bbed5e6ac1e247c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
