[CLSA-2026:1791841538] nodejs: Fix of CVE-2026-9496
Type:
security
Severity:
Important
Release date:
2026-10-12 21:45:48 UTC
Description:
- CVE-2026-9496: strip the committish in addGitSha() of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU
CVEs fixed:
Updated packages:
  • nodejs-16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:150997d82fdf09ff25775b17a1382436d54fa86f3ca3c179da39df34b5398ea6
  • nodejs-16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:a3c16824f1e174e8e8d6699af583a97dc2a4383387027b29643309aff9659585
  • nodejs-16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:81fa83e5c7462041cb63bfeece7e4f1f62e2411abaad817a7efcb3409dc77227
  • nodejs-devel-16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:6907d06b2c4c3200dc5b1db996d5bca94d0c133c33efdad5c4b8a10d776afdee
  • nodejs-devel-16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:dc218e0eae45763feb8656be71a07c296404b9671c3de25ceb8b4909927ed161
  • nodejs-devel-16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:3c9f9549fda856b37548b19c9abf319b87be0c8fb6dabe275a5048aac236f69a
  • nodejs-docs-16.20.2-8.el9_6.tuxcare.els22.noarch.rpm
    sha:9ed7448ba28aa96ca1fba5376ecb93bb9a389f9194995e6a31bf90aca2103da9
  • nodejs-full-i18n-16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:95773f69aa8e46ee9805a734f6fe264cb88c9e6760bbbac43e824b72f2325623
  • nodejs-full-i18n-16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:665fd00891e4d2bdc04da8beae304dc5bbc89314747b6f67786c9c30e1441822
  • nodejs-full-i18n-16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:548d14e33b9e76551ddba75dc1f5351dcd54e63bcfcd434478cef4611100f03e
  • nodejs-libs-16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:52066d3a641caeff0d2b6a035c91db6c8ffa49a8ad3536f5f2177f5ae636ed88
  • nodejs-libs-16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:4061f30a874ee5ca582b3e54e115651bc560901b5c4611d48482813ece5ae357
  • nodejs-libs-16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:39eb034a361a4b284179ffee7b08a69a688c328fe16174a056ed94a4daada803
  • npm-8.19.4_1.16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:7559344d738d7d82715033b01a29a3181569b496e5c79fe2e0e176cdb306a513
  • npm-8.19.4_1.16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:be1847a7bf6bd6e97094b53993e98d7c2937eeb39fbb0bb5059d21daa2c86885
  • npm-8.19.4_1.16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:9f8c199196da8f8e4197f1b7f96eef73bf5c79e6975214632d68394b302d7216
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els22.aarch64.rpm
    sha:9e8ff23f522cad27d3ce6c084edba7ed8f3af9cdbcdb39e0b03e89080e43418f
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els22.i686.rpm
    sha:0b239273ce7c4e28a5b57480dff4b79937ac52bc8e0e826e5300e73a769ca6c4
  • v8-devel-9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els22.x86_64.rpm
    sha:34161ede45152a1025a5c0b09f0b9dca925e4a11a00a7d99b6a94173fdf9cc78
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.