Release date:
2026-09-03 10:18:40 UTC
Description:
- CVE-2026-56846: retain HTTP/2 header-block memory in session accounting for
the stream's lifetime instead of releasing it once headers reach JS,
preventing a maxSessionMemory accounting bypass via stalled headers
- CVE-2026-56848: defer RST_STREAM submission while nghttp2 is still
dispatching receive callbacks, preventing a re-entrant session send that
could crash the process
Updated packages:
-
nodejs-16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:550fad1f4a9efe29f3ea7919be84aa894d06831fcbcb59bc477cf9874572a223
-
nodejs-devel-16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:c7b972a382d5d675ab984c3e921396d6ab730a99916386101e91e5024cb334b3
-
nodejs-docs-16.20.2-8.el9_2.tuxcare.els17.noarch.rpm
sha:9a4b54e8eb699f89b6c8aaf7ce326c0ec28cbb3ff08a03f8372be3e242674d02
-
nodejs-full-i18n-16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:63c919ffcc4ced52050105b99bca758721c7b5d3746b7aa9b7c13a99b73182c9
-
nodejs-libs-16.20.2-8.el9_2.tuxcare.els17.i686.rpm
sha:91603ce6c565f6e637672884d19c9ca94967f7ea2e2526d21ee49b530532cdca
-
nodejs-libs-16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:095223c722d1fe49985e7373d9132340102426fce9c525979ceb0d3e0395399f
-
npm-8.19.4_1.16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:8d532604e7caac2d298006ef1fcfc6d96be277f875b81c2442bdbc1ee4f9c3f4
-
v8-devel-9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els17.x86_64.rpm
sha:e4708e927c0e2923fec65fc389e7bc7cf86414183e713d8f385303db4426de31
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
