Release date:
2026-05-28 07:51:21 UTC
Description:
* SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
the internal string table, letting attacker-controlled JSON.parse input
degrade performance in a local PoC against V8 10.2.154.26
- debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
value stored in a Name's hash_field via a 3-round xorshift-multiply
with compile-time constants (no upstream Node.js 18 fix exists — 18.x
went EOL before disclosure; this is an adapted reduced port, no
rapidhash / HashSeed-view refactor)
- CVE-2026-21717
Updated packages:
-
alt-nodejs18-docs_18.20.8-13_amd64.deb
sha:eba669d0584611eb4de287b3b2e84fc34e96e596
-
alt-nodejs18-nodejs_18.20.8-13_amd64.deb
sha:0babfaa5a440d431011b9fbab5ee34f81a20adb9
-
alt-nodejs18-nodejs-devel_18.20.8-13_amd64.deb
sha:3ab6c4d082411e0f416f0cd95c912c55f163324f
-
alt-nodejs18-npm_10.8.2-18.20.8.13_amd64.deb
sha:184abe771a41c08621943e6cba210a6aceaa7826
-
alt-nodejs18-docs_18.20.8-13_arm64.deb
sha:a585955d7098c34c903b8a2fe4311e3fb0be5398
-
alt-nodejs18-nodejs_18.20.8-13_arm64.deb
sha:0026621200bc1cecf8265ef4f764bed17be05434
-
alt-nodejs18-nodejs-devel_18.20.8-13_arm64.deb
sha:ce43372d20f419fb77a720ae3c1452b3769cbdb5
-
alt-nodejs18-npm_10.8.2-18.20.8.13_arm64.deb
sha:1a3f06a65b4f0164c7910ab995b5ff75aa90d713
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
