alt-nodejs14-nodejs (14.21.3-5) stable; urgency=high

  * SECURITY UPDATE: Node.js cryptographic vulnerability
    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 10:15:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els4) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 03 Nov 2025 13:30:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els3) stable; urgency=critical

  * SECURITY UPDATE: Node.js policy bypass vulnerabilities
    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 15 Oct 2025 11:27:51 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep 
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 06 Oct 2025 11:16:21 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.
  
 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 22 Sep 2025 11:13:25 +0000

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 10 Sep 2025 11:41:52 +0000

alt-nodejs14-nodejs (14.21.3-3) stable; urgency=medium

  * Fixed dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-2) stable; urgency=medium

  * ALTNJS-111: Fix non-functional npm

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-1) stable; urgency=medium

  * Update to 14.21.3 version

 -- CloudLinux Packaging Team <ssazonov@cloudlinux.comm>  Tue, 16 May 2023 07:02:37 +0000

alt-nodejs14-nodejs (14.21.2-1) stable; urgency=medium

  * update to 14.21.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 24 Jan 2023 14:20:00 +0200


alt-nodejs14-nodejs (14.20.1-1) stable; urgency=medium

  * update to 14.20.1 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 27 Sep 2022 13:50:00 +0200

alt-nodejs14-nodejs (14.20.0-2) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 07 Feb 2022 15:00:00 +0100
