[CLSA-2026:1780057813] Fix CVE(s): CVE-2026-21717

Type:

security

Severity:

Moderate

Release date:

2026-05-29 12:30:19 UTC

Description:

   * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
     the internal string table, letting attacker-controlled JSON.parse input
     degrade performance in a local PoC against V8 10.2.154.26
     - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
       value stored in a Name's hash_field via a 3-round xorshift-multiply
       with compile-time constants (no upstream Node.js 18 fix exists — 18.x
       went EOL before disclosure; this is an adapted reduced port, no
       rapidhash / HashSeed-view refactor)
     - CVE-2026-21717

Updated packages:

alt-nodejs18-docs_18.20.8-13_amd64.deb
sha:8068fd9377838c113d0bcd3b5d7dc673559b308c
alt-nodejs18-nodejs_18.20.8-13_amd64.deb
sha:ca6d8a4c4750ca915d961022d8f1e4d674aa14d8
alt-nodejs18-nodejs-devel_18.20.8-13_amd64.deb
sha:5a568b1c49cadca7ac44e41c2744304b54e16d8c
alt-nodejs18-npm_10.8.2-18.20.8.13_amd64.deb
sha:afcf488ce953c8c9d57b6b4ba12bb6cb4580ee62

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.