Release date:
2026-07-09 14:15:38 UTC
Description:
- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent
silent authority rebinding via C-string truncation in the resolver bindings
(backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes)
- CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a
malicious server can no longer cause unbounded memory growth via ORIGIN frames
(backport of nodejs/node@c79968e1)
- CVE-2026-48933: crypto: guard the cipher output-length computation against
signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc
(Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892)
Updated packages:
-
alt-nodejs14-nodejs-14.21.3-24.el9.x86_64.rpm
sha:4113596620db028d5e8af7a667155b19dabb6b38155029ab109fbcf841ed9ca2
-
alt-nodejs14-nodejs-devel-14.21.3-24.el9.x86_64.rpm
sha:851b2d8c75bb1085ea86e6bcd814d91f136592580c73d56fc3560210f9a34181
-
alt-nodejs14-nodejs-docs-14.21.3-24.el9.noarch.rpm
sha:eedd26dda54f2b7ff5e0571c0dae809735dc5f037c3205822536cf3206cf1664
-
alt-nodejs14-npm-6.14.18-14.21.3.24.el9.x86_64.rpm
sha:a6ee564ff892d24bfb5502f4f1a241b2bd4ce546ab3898401cecac2706e32d45
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
