Release date:
2026-09-04 16:21:00 UTC
Description:
- CVE-2026-56846: retain HTTP/2 header-block memory in session accounting for
the stream's lifetime instead of releasing it once headers reach JS,
preventing a maxSessionMemory accounting bypass via stalled headers
- CVE-2026-56848: defer RST_STREAM submission while nghttp2 is still
dispatching receive callbacks, preventing a re-entrant session send that
could crash the process
Updated packages:
-
nodejs-16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:2d78da411d0e06cb9d97f0f59735344d01108c373cd66233d2e86e44b3228ebf
-
nodejs-devel-16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:b1af6c62b39d6f033254ea10bab2f6badb7ded930ac67bb77b09dad1b7f8ab68
-
nodejs-docs-16.20.2-8.el9_6.tuxcare.els17.noarch.rpm
sha:d5e9857b27517d688fafb47f26843b14d023467d6eee7a150aed5eb064a6cd00
-
nodejs-full-i18n-16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:aa39119121bbeeab6b7951bc21ec7b2d5244b2053cf5fb48529001c22dea5c87
-
nodejs-libs-16.20.2-8.el9_6.tuxcare.els17.i686.rpm
sha:a3a053bb3d608128252ce3d2578c8b927ddcee73ea78f2ef20d0722829442737
-
nodejs-libs-16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:40eec37da319f7f1b03acf5919065c5f225cca78a99889e1ba9e68dfc043cbfc
-
npm-8.19.4_1.16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:d9140571d19280db378bb4a16de596853ef40744f5ab66c594ef2d0518b30913
-
v8-devel-9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els17.x86_64.rpm
sha:4cf82796f140d4221fa6920f13bb88d10a0abb9053f1318a1a38b46073acc15b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
