alt-nodejs14-nodejs (14.21.3-34) stable; urgency=medium

  * SECURITY UPDATE: enforce maxHeadersCount in the HTTP parser, so a
    request carrying more header pairs than configured is rejected instead
    of silently truncated
    - debian/patches/CVE-2026-58044.patch: enforce maxHeadersCount in the
      HTTP parser, so a request carrying more header pairs than configured
      is rejected instead of silently truncated
    - CVE-2026-58044

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 05 Oct 2026 00:00:00 +0000

alt-nodejs14-nodejs (14.21.3-33) stable; urgency=medium

  * ALTNJS-295: derive the alt-nodejs14-npm package version from the bundled
    npm version and debian/changelog in debian/rules, so every Debian revision
    bump also changes the npm package version. Up to now it came only from
    debian/alt-nodejs14-npm.changelog, and the Debian rebuild in build
    6a8cac054c34bf1292240b1a re-shipped the npm package under its previous
    version with different contents.

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 05 Oct 2026 18:37:13 +0400

alt-nodejs14-nodejs (14.21.3-32) stable; urgency=medium

  * SECURITY UPDATE: https.Agent socket-pool names built from a `pfx` array of
    { buf, passphrase } objects collapse to the literal `[object Object]`, so
    requests configured with different mTLS client certificates share one pool
    entry and can reuse each other's authenticated socket or TLS session
    (CVE-2026-56850)
    - debian/patches/CVE-2026-56850.patch: add getPfxAgentKey() to
      lib/https.js and route the `pfx` leg of Agent.prototype.getName()
      through it, so an array-valued `pfx` contributes each entry's raw
      certificate buffer and its effective passphrase to the pool name; a
      non-array `pfx` keeps the name it had. Also adds the upstream
      regression tests test/parallel/test-https-agent-getname.js (new
      assertions) and test/parallel/test-https-agent-pfx-object-array-reuse.js
    - CVE-2026-56850

  * SECURITY UPDATE: dns.resolveAny() aborts the process when a DNS reply
    carries more than 256 A records, which a hostile or merely large
    authoritative answer can trigger repeatedly for a denial of service
    (CVE-2026-58042)
    - debian/patches/CVE-2026-58042.patch: in src/cares_wrap.cc, replace the
      fixed ares_addrttl[256] / ares_addr6ttl[256] TTL buffers with
      std::vectors sized from the reply's ANCOUNT via the new
      GetAnswerCountForTTLBuffer() and MakeAddrTTLBuffer() helpers, so
      naddrttls can no longer come back clamped below the record count and
      trip CHECK_EQ(naddrttls, a_count); also adds the regression test
      test/parallel/test-dns-resolveany-ttl-overflow.js
    - CVE-2026-58042

  * SECURITY UPDATE: the synchronous node:zlib entry points abort the process
    when handed a TypedArray whose byteLength is spoofed with a getter, which
    can be repeated for a denial of service (CVE-2026-58045)
    - debian/patches/CVE-2026-58045.patch: in src/node_zlib.cc, turn the two
      CHECK(Buffer::IsWithinBounds(...)) assertions in
      CompressionStream::Write() into THROW_ERR_OUT_OF_RANGE() so an
      out-of-bounds input or output buffer raises a catchable RangeError with
      code ERR_OUT_OF_RANGE instead of aborting; also adds the upstream
      regression assertions to test/parallel/test-zlib-invalid-input.js
    - CVE-2026-58045

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-31) stable; urgency=high

  * SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the
    maxSessionMemory limit
    - debian/patches/CVE-2026-56846.patch: keep the decoded header block
      charged against maxSessionMemory for as long as the stream can still
      reach it (src/node_http2.{cc,h}). HandleHeadersFrame() no longer
      un-charges current_headers_length_ the moment the block is handed to
      JS; it moves the amount into a new per-stream counter,
      Http2Stream::retained_headers_length_, and RemoveStream() drains both
      counters when the stream is erased. Without this, a peer that opens
      many streams with large header blocks and never lets them complete
      (for example with initialWindowSize 0) keeps unbounded header memory
      alive while the credit-based limit reads as near zero, so
      CanAddStream() never refuses a new stream and nghttp2 never answers
      NGHTTP2_ENHANCE_YOUR_CALM -- remote memory exhaustion (backport of
      nodejs/node@f14d78b9, the v22.x release-line commit shipped in
      v22.23.2, carrying the upstream regression test with two deviations.
      The header block is built as an object with a multi-valued cookie
      field because 14.21.3's Http2Session#request() rejects the flat array
      upstream passes; that one is required, or the test throws
      ERR_INVALID_ARG_TYPE before it ever reaches the fix. The server also
      raises maxHeaderListPairs to 4096, which is hardening: it puts the
      pair-count branch of AddHeader() structurally out of reach, leaving
      the session-memory branch as the only thing the test can be
      measuring. The wire shape still matches upstream's -- 120 cookie
      fields plus four pseudo-headers, 124 entries. The three
      doc/api/http2.md hunks are deliberately omitted, so the -docs
      sub-package keeps describing maxSessionMemory without the "header
      blocks retained by open streams" clause)
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 re-entrant RST_STREAM for refused streams ->
    heap use-after-free
    - debian/patches/CVE-2026-56848.patch: stop force-purging pending
      session data when a RST_STREAM is submitted for a refused stream from
      inside an nghttp2 callback scope (src/node_http2.cc).
      Http2Stream::SubmitRstStream() previously called
      session_->SendPendingData() for every code except NGHTTP2_CANCEL,
      re-entering nghttp2_session_mem_send() while
      nghttp2_session_mem_recv() was still on the stack, and the send path
      could close and free streams the active receive operation was still
      using. NGHTTP2_REFUSED_STREAM now takes the same deferred path: the
      reset is flushed with FlushRstStream() and the pending data is left
      for the enclosing Http2Scope to send. Reachable by sending GOAWAY with
      last_stream_id 0 immediately followed by HEADERS for further streams,
      which nghttp2 refuses from inside the same receive callback (backport
      of nodejs/node@daa6d25e, the v22.x release-line commit shipped in
      v22.23.2, carrying the upstream regression test verbatim; upstream's
      cosmetic re-indent of the pre-existing AddPendingRstStream block is
      not carried)
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-30) stable; urgency=high

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode
    dot separators
    - debian/patches/CVE-2026-48618.patch: IDNA-normalize the peer hostname
      with domainToASCII() before splitHost() in tls.checkServerIdentity()
      (lib/tls.js), so the verifier splits the same DNS labels the resolver
      does; a name such as "foo。bar.example.com" can no longer be
      authenticated by a certificate for *.example.com. Includes the
      mandatory IPv6 follow-up so IP-Address SANs keep matching IPv6 hosts
      (backport of nodejs/node@2197a471 + @1d87a240 adapted to 14.21.3)
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching -> mTLS
    authorization bypass
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the RegExp
      built by tls.Server.prototype.addContext() (lib/_tls_wrap.js), so an
      uppercase or mixed-case SNI hostname selects its per-hostname
      SecureContext instead of silently falling back to the server default
      and bypassing per-tenant client-certificate policy, as required by
      RFC 6066 Section 3 (backport of nodejs/node@39d1d096)
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session reuse
    - debian/patches/CVE-2026-48934.patch: bind a reusable client TLS
      session to the host it was authenticated for (lib/_tls_wrap.js) by
      wrapping the session blob with the server identity and refusing to
      reuse it for a different one; a session obtained from host A can no
      longer be replayed against host B, where checkServerIdentity() is
      skipped because the session is resumed (backport of
      nodejs/node@fd890ba0)
    - CVE-2026-48934
  * SECURITY UPDATE: https.Agent shares sockets and TLS sessions across
    different checkServerIdentity callbacks
    - debian/patches/CVE-2026-58040.patch: incomplete-fix follow-up to
      CVE-2026-48934, which bound reusable sessions to the authenticated
      host in lib/_tls_wrap.js but left the https.Agent layer untouched:
      lib/https.js never referenced checkServerIdentity, so getName() did
      not key on it, createConnection() cached and reused sessions purely
      on options._agentKey, and there was no keepSocketAlive override.
      A request carrying a custom per-request checkServerIdentity is now
      tagged with a symbol-keyed marker that is folded into the agent key,
      excluded from the session cache and refused re-entry to the
      keep-alive pool, so a connection authenticated under one callback can
      no longer be resumed under another -- where the identity check is
      skipped altogether (backport of nodejs/node@51123159, the v22.x
      release-line commit shipped in v22.23.2; its upstream
      establishTunnel() hunk is dropped because 14.21.3 has no proxy-tunnel
      support in lib/https.js)
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-29) stable; urgency=high

  * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination
    in the bundled llhttp parser
    - debian/patches/CVE-2025-23167.patch: restore terminator validation in the
      loose (non-strict) state machine of the bundled llhttp, which Node compiles
      by default (LLHTTP_STRICT_MODE is never set). Unlike alt-nodejs16/18 this
      package still ships llhttp 2.1.6 after the whole series -- CVE-2024-22019
      deliberately patches the bundled parser in place instead of rebasing it to
      6.x -- so every state and error label here was re-derived on this tree and
      nothing was transferred from the sibling packages: headers_almost_done,
      chunk_size_almost_done and the chunk_data_almost_done /
      chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after
      a CR instead of consuming any byte, and res_line_almost_done requires the LF
      after the response status line's CR, so a header block ending in "\r\n\rX"
      or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of
      silently swallowing the byte and parsing the bytes that follow as a second,
      smuggled request; each accept/reject edge was derived from the loose
      machine's own goto graph rather than by copying the strict machine's labels,
      which are not interchangeable between the two halves (no upstream Node.js 14
      fix exists -- 14.x went EOL in 2023, and upstream fixed this by replacing the
      parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR
      nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2)
    - NOTE: llhttp 2.1.6 has no LENIENT_OPTIONAL_LF_AFTER_CR flag, so unlike
      upstream llhttp 9 this rejection is unconditional: --insecure-http-parser
      can no longer restore the previous lenient framing. Nothing that was
      previously toggleable becomes untoggleable (these states were
      unconditionally lenient before), but an operator relying on that flag to
      tolerate malformed framing will now get 400 responses.
    - CVE-2025-23167

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 24 Aug 2026 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-28) stable; urgency=high

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:33:06 +0400

alt-nodejs14-nodejs (14.21.3-27) stable; urgency=high

  * SECURITY UPDATE: HTTP/2 session left alive after an internal GOAWAY
    - debian/patches/CVE-2026-48937.patch: when nghttp2 hits a low-level
      protocol error it calls nghttp2_session_terminate_session() itself, which
      queues a GOAWAY and returns success from nghttp2_session_mem_recv()
      without invoking any application-level callback. Node therefore never
      learned the session had died: no 'error', no 'close', and the
      Http2Session kept its streams, buffers and handle alive on a dead socket,
      which an unauthenticated peer could repeat to exhaust memory and handles.
      Http2Session::OnFrameSent() now flags a GOAWAY that we did not initiate
      ourselves and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript
      once the GOAWAY has been written (backport of nodejs/node@a8a0d128;
      the !IsGracefulCloseInitiated() term is dropped because Node 14 has no
      graceful_close_initiated_ flag -- session.close() reaches the native
      layer through Http2Session::Goaway(), covered by the new
      goaway_initiated_ flag, and Http2Session::Close() sets the closing flag
      before terminating the session). Only the new regression test is taken
      from upstream: the flow-control test changes there track nghttp2 v1.67.0+
      behaviour, while this release bundles 1.42.0, where a stream-level flow
      control violation still yields RST_STREAM
    - CVE-2026-48937

 -- Viktor Borzov <vborzov@cloudlinux.com>  Thu, 13 Aug 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-26) stable; urgency=high

  * SECURITY UPDATE: code injection through WebAssembly export names
    - debian/patches/CVE-2023-39333.patch: createDynamicModule() built the ESM
      facade for a wasm module by interpolating each export name raw into three
      code positions, so a .wasm module exporting a non-identifier name could
      break out of the intended syntax and evaluate arbitrary JavaScript
      outside the WebAssembly sandbox. The facade now uses index-derived local
      bindings ($export_N) and a JSONStringify-quoted import.meta.exports[...]
      key. Adapted from nodejs/node@eaf9083c: V8 8.4.371.23 predates ES2022
      arbitrary module namespace names, so upstream's `export { $export_N as
      "string" }` would be a SyntaxError for every wasm module here; the export
      clause is instead emitted only for names matching the IdentifierName
      grammar, with non-identifier names reachable through import.meta.exports
      only (they were unimportable on this V8 either way)
    - CVE-2023-39333
  * SECURITY UPDATE: http.Agent keep-alive response-queue poisoning
    - debian/patches/CVE-2026-48931.patch: once responseKeepAlive() detaches the
      parser and removes the 'data' listener, a socket idling in the Agent
      freeSockets pool has no data consumer, so unsolicited bytes from a
      malicious peer are consumed as the response to the *next* request that
      reuses the socket. Install a handle-level read guard on idle pooled
      sockets that destroys the socket on any such data, and remove it again in
      reuseSocket() (backport of nodejs/node@0a22d401 squashed with its
      regression follow-up nodejs/node@eaa29254, which replaces the original
      public 'data' listener plus resume() -- that combination put pooled
      sockets into flowing mode and made the shipped
      test-http-agent-keepalive.js fail on listenerCount('data'))
    - CVE-2026-48931

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-25) stable; urgency=high

  * SECURITY UPDATE: embedded-NUL hostnames -> silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: reject hostnames containing an
      embedded NUL byte in dns.lookup(), dnsPromises.lookup() and
      net.connect()/net.createConnection() before they reach the C resolver,
      which would otherwise truncate the string at the NUL and resolve/connect
      to a different authority than the one validated in JavaScript. Adds
      validateStringWithoutNullBytes() in lib/internal/validators.js (backport
      of nodejs/node@7dafafa2 adapted to 14.21.3)
    - CVE-2026-48930
  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the client-side originSet at a
      configurable maxOriginSetSize (default 128) in lib/internal/http2/core.js;
      a malicious server sending unlimited ORIGIN frames now trips
      ERR_HTTP2_TOO_MANY_ORIGINS instead of growing the set without bound
      (backport of nodejs/node@c79968e1)
    - CVE-2026-48619
  * SECURITY UPDATE: cipher output-length signed-int overflow (~2 GiB input)
    - debian/patches/CVE-2026-48933.patch: guard the len + block_size output
      length computation in CipherBase::Update (src/node_crypto.cc) against
      signed-int overflow that produced a bogus buffer size passed to
      EVP_CipherUpdate() -> OOB write / crash. Node 14 predates WebCrypto, so
      the INT_MAX guard from nodejs/node@98fbc892 is adapted to the legacy
      crypto.createCipheriv().update() path
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-24) stable; urgency=high

  * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__
    - debian/patches/CVE-2023-30581.patch: install the policy-aware require()
      on the module prototype and assign process.mainModule via
      setOwnProperty(), so process.mainModule.__proto__.require() can no
      longer escape the --experimental-policy manifest restrictions
    - CVE-2023-30581
  * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service
    - debian/patches/CVE-2023-44487.patch: backport the upstream nghttp2
      1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2
      1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM
      frames now tear the connection down with GOAWAY instead of doing
      unbounded per-stream work
    - CVE-2023-44487

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 09 Jun 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-23) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 8.4.371.23
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream V8 8.4 backport exists; this
      is an adapted reduced port — no rapidhash/HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 22 May 2026 10:00:00 +0200

alt-nodejs14-nodejs (14.21.3-22) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 15:00:00 +0200

alt-nodejs14-nodejs (14.21.3-21) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-19) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13
  * Use alt-libicu73 instead of alt-libicu71 on Debian >= 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 11 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-18) stable; urgency=high

  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466
  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 09 Feb 2026 14:00:00 +0100

alt-nodejs14-nodejs (14.21.3-17) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that could expose uninitialized
      memory when using vm module with timeout options
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 02 Feb 2026 22:00:00 +0000

alt-nodejs14-nodejs (14.21.3-16) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs14-nodejs (14.21.3-15) stable; urgency=high

  * ALTNJS-230: Added section in spec file for file conflict fix on updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Mon, 22 Dec 2025 12:00:00 +0400
 
alt-nodejs14-nodejs (14.21.3-14) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 12 Dec 2025 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-13) stable; urgency=high

  * ALTNJS-230: Fix error when updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 05 Dec 2025 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 03 Dec 2025 15:06:00 +0000
 
alt-nodejs14-nodejs (14.21.3-11) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 02 Dec 2025 14:43:54 +0000

alt-nodejs14-nodejs (14.21.3-10) stable; urgency=medium

  * Build for Ubuntu 24.04

    - debian/patches/add-cstdin-include.patch: add missing includes to v8 headers

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Mon, 01 Dec 2025 11:38:00 +0400

alt-nodejs14-nodejs (14.21.3-9) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      function to prevent tampering with Hash class internals in policy
      mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 19 Nov 2025 09:35:26 +0000

alt-nodejs14-nodejs (14.21.3-8) stable; urgency=high

  * ALTNJS-227: fix build for debian 12

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 17 Nov 2025 21:00:00 +0400

alt-nodejs14-nodejs (14.21.3-7) stable; urgency=high

  * SECURITY UPDATE: HTTP Request Smuggling vulnerability via empty headers separated by CR
    - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR
      in HTTP header fields, add lenient flag checks before allowing CR without LF,
      add test file to verify the fix prevents request smuggling attacks
    - CVE-2023-30589

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:48:05 +0000

alt-nodejs14-nodejs (14.21.3-6) stable; urgency=high

  * SECURITY UPDATE: A privilege escalation vulnerability in the experimental policy mechanism
    - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled,
      update deprecations and errors docs, add new test to ensure denial behavior,
      include new policy + app test fixtures
    - CVE-2023-32559

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:28:51 +0000

alt-nodejs14-nodejs (14.21.3-5) stable; urgency=high

  * SECURITY UPDATE: Node.js cryptographic vulnerability
    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 10:15:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els4) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 03 Nov 2025 13:30:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els3) stable; urgency=critical

  * SECURITY UPDATE: Node.js policy bypass vulnerabilities
    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 15 Oct 2025 11:27:51 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep 
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 06 Oct 2025 11:16:21 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.
  
 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 22 Sep 2025 11:13:25 +0000

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 10 Sep 2025 11:41:52 +0000

alt-nodejs14-nodejs (14.21.3-3) stable; urgency=medium

  * Fixed dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-2) stable; urgency=medium

  * ALTNJS-111: Fix non-functional npm

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-1) stable; urgency=medium

  * Update to 14.21.3 version

 -- CloudLinux Packaging Team <ssazonov@cloudlinux.comm>  Tue, 16 May 2023 07:02:37 +0000

alt-nodejs14-nodejs (14.21.2-1) stable; urgency=medium

  * update to 14.21.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 24 Jan 2023 14:20:00 +0200


alt-nodejs14-nodejs (14.20.1-1) stable; urgency=medium

  * update to 14.20.1 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 27 Sep 2022 13:50:00 +0200

alt-nodejs14-nodejs (14.20.0-2) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 07 Feb 2022 15:00:00 +0100
