[CLSA-2026:1779707872] Fix CVE(s): CVE-2026-21714

Type:

security

Severity:

Moderate

Release date:

2026-05-25 17:34:46 UTC

Description:

   * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
     - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
       OnInvalidFrame so Http2Session is destroyed after invalid connection-level
       WINDOW_UPDATE instead of leaking
     - CVE-2026-21714

Updated packages:

alt-nodejs18-docs_18.20.8-12_amd64.deb
sha:df59ce9ce71cf36f8dc79d5d69fc748725965a13
alt-nodejs18-nodejs_18.20.8-12_amd64.deb
sha:d7c7b14ef41f9279b7650959e089ace50a2dc8a5
alt-nodejs18-nodejs-devel_18.20.8-12_amd64.deb
sha:57fbe951297c1e9450a847d7df6f93a45a7cf2da
alt-nodejs18-npm_10.8.2-18.20.8.12_amd64.deb
sha:dc21daeb4cb0e962e46b821a1cc878af0c80b5be

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.