Release date:
2026-05-07 16:00:28 UTC
Description:
* SECURITY UPDATE: HTTP server crash on __proto__ header
- debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
trailersDistinct destination maps with { __proto__: null } so a
__proto__ request header no longer resolves to Object.prototype and
cause an uncaught TypeError when req.headersDistinct or
req.trailersDistinct is accessed
- CVE-2026-21710
Updated packages:
-
alt-nodejs16-docs_16.20.2-17_amd64.deb
sha:306ae7466fb83dad3b8e02a9e9fdc47d5ff53799
-
alt-nodejs16-nodejs_16.20.2-17_amd64.deb
sha:11cadecc732e1eae042ca784519cd8c15aa317f8
-
alt-nodejs16-nodejs-devel_16.20.2-17_amd64.deb
sha:0f1495ede3891e1be4af29aacdfd7403f2a14ab6
-
alt-nodejs16-npm_8.19.4-16.20.2-17_amd64.deb
sha:9cb67e50e075747a2c7f30cbefabd7eed7f92db3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
