[CLSA-2026:1780062710] Fix CVE(s): CVE-2026-21717

Type:

security

Severity:

Moderate

Release date:

2026-05-29 13:51:55 UTC

Description:

   * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
     the internal string table, letting attacker-controlled JSON.parse input
     degrade performance in a local PoC against V8 9.4.146.26
     - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
       value stored in a Name's hash_field via a 3-round xorshift-multiply
       with compile-time constants (no upstream Node.js 16 fix exists — 16.x
       went EOL before disclosure; this is an adapted reduced port, no
       rapidhash / HashSeed-view refactor)
     - CVE-2026-21717

Updated packages:

alt-nodejs16-docs_16.20.2-20_amd64.deb
sha:e6a4c375fe337058edf236522ef784bb1f61b3dd
alt-nodejs16-nodejs_16.20.2-20_amd64.deb
sha:18e64b53b63163f4a6f34814301c5d8557b5a62f
alt-nodejs16-nodejs-devel_16.20.2-20_amd64.deb
sha:a613c0404c4aec5ba30aac60b8737fc137bccad0
alt-nodejs16-npm_8.19.4-16.20.2-20_amd64.deb
sha:24c9bec3a1a9e784c23e825b2c6b8a2175ddb02b

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.