Release date:
2026-07-09 16:57:13 UTC
Description:
- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent
silent authority rebinding via C-string truncation in the resolver bindings
(backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes)
- CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a
malicious server can no longer cause unbounded memory growth via ORIGIN frames
(backport of nodejs/node@c79968e1)
- CVE-2026-48933: crypto: guard the cipher output-length computation against
signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc
(Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892)
Updated packages:
-
alt-nodejs14-nodejs-14.21.3-24.el7.x86_64.rpm
sha:d203977d255c233a40476bcff4848f408e5eddae631de70c3bbd9f42f98d9609
-
alt-nodejs14-nodejs-devel-14.21.3-24.el7.x86_64.rpm
sha:c3438cab356e01bb28351db089b95862c86c54b635d668ccebdebc5f97237545
-
alt-nodejs14-nodejs-docs-14.21.3-24.el7.noarch.rpm
sha:ecc41feefb766707ac8bf4c46643d51e5117f859692fc359a1f81f551f6998bf
-
alt-nodejs14-npm-6.14.18-14.21.3.24.el7.x86_64.rpm
sha:e39db1a642195252167ff5139e075c11fe2f4f8edb9098b8b06d25691a229746
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
