alt-nodejs16-nodejs (16.20.2-27) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks retained by JS evade
    maxSessionMemory (CVE-2026-56846) -- Http2Session::HandleHeadersFrame()
    un-charged the decoded header block from the session memory total as soon
    as it handed the headers to the JS layer, but those JS objects can keep
    the block alive for the whole lifetime of the stream, so a peer that opens
    many streams with large header blocks and never lets them complete keeps
    unbounded header memory reachable while currentSessionMemory reads near
    zero and maxSessionMemory never refuses a stream
    - debian/patches/CVE-2026-56846.patch: backport of upstream f14d78b9e020
      (first in v22.23.2), moving the octets into a new per-stream counter
      retained_headers_length_ instead of decrementing the session total, and
      draining both header counters in Http2Session::RemoveStream() so the
      accounting is released exactly when the stream goes away (Node 16 is
      EOL, no upstream 16.x fix)
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 heap use-after-free via re-entrant RST_STREAM for
    a refused stream (CVE-2026-56848) -- Http2Stream::SubmitRstStream()
    deferred its force purge of pending session data only for
    NGHTTP2_CANCEL, so for a refused stream it called SendPendingData(), and
    hence nghttp2_session_mem_send(), while nghttp2_session_mem_recv() was
    still on the stack; the send path can then close and free streams the
    in-flight receive operation is still using
    - debian/patches/CVE-2026-56848.patch: backport of upstream daa6d25e3dce
      (first in v22.23.2), adding a second early return that calls
      FlushRstStream() and returns when the session is in scope and the code
      is NGHTTP2_REFUSED_STREAM, so the frame goes through nghttp2's normal
      queue instead of a re-entrant purge (Node 16 is EOL, no upstream 16.x
      fix)
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 00:00:00 +0000


alt-nodejs16-nodejs (16.20.2-26) stable; urgency=medium

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode dot
    separators (CVE-2026-48618) -- tls.checkServerIdentity() split the hostname
    on the ASCII dot only, while the resolver applies IDNA mapping under which
    U+3002 / U+FF0E / U+FF61 are also label separators, so a certificate for
    *.example.com authenticated a host two levels below it
    - debian/patches/CVE-2026-48618.patch: backport of upstream 2197a47144
      (first in v22.23.0) plus the mandatory follow-up 1d87a24050 ("tls: match
      IPv6 hosts against IP-Address SANs"), feeding the IDNA-normalized
      hostname to splitHost() while keeping IP literals matched against the
      original host (Node 16 is EOL, no upstream 16.x fix)
    - CVE-2026-48618
  * SECURITY UPDATE: mTLS authorization bypass via case-sensitive SNI context
    matching (CVE-2026-48928) -- tls.Server.prototype.addContext() built the
    SNI RegExp with no flags, so an uppercase or mixed-case SNI hostname missed
    its per-hostname SecureContext and fell back to the default context
    - debian/patches/CVE-2026-48928.patch: backport of upstream 39d1d09684
      (first in v22.23.0), adding the 'i' flag to that RegExp so SNI context
      selection on a full handshake is case-insensitive as RFC 6066 Section 3
      requires
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via cross-host
    session reuse (CVE-2026-48934) -- a resumed session skips
    checkServerIdentity(), and a client session carried no record of the host
    it was authenticated for, so a session obtained from host A could be
    replayed against host B
    - debian/patches/CVE-2026-48934.patch: backport of upstream fd890ba01d
      (first in v22.23.0), recording in the session blob the server identity a
      client session was established against -- its servername, else its host
      -- and refusing to resume a session whose recorded identity differs from
      the one being connected to
    - behaviour change: tlsSocket.getSession() and the 'session' event now
      return a wrapped blob ("\0nodejs:tls:session:1\0" + uint16be servername
      length + servername + the raw session) rather than the bare OpenSSL
      session. Callers that merely store it and pass it back to
      tls.connect({ session }) are unaffected; callers that parse it as a raw
      OpenSSL session must be updated. A raw, unwrapped session is now
      refused on any client connection with rejectUnauthorized !== false
    - CVE-2026-48934
  * SECURITY UPDATE: HTTPS agent identity verification bypass via connection
    and TLS session reuse (CVE-2026-58040) -- incomplete-fix follow-up to
    CVE-2026-48934; lib/https.js never referenced checkServerIdentity, so
    Agent.prototype.getName() did not key on it, createConnection() cached and
    replayed sessions purely on options._agentKey, and no keepSocketAlive
    override existed, letting a connection authenticated under one
    per-request checkServerIdentity callback be reused for a request that
    supplied a different one -- and a resumed session skips the check entirely
    - debian/patches/CVE-2026-58040.patch: backport of upstream 51123159fe
      (first in v22.23.2), tagging requests that carry a per-request
      checkServerIdentity so they get their own https.Agent pool key, are
      excluded from TLS session lookup and caching, and have their socket
      destroyed instead of parked in freeSockets (Node 16 is EOL, no upstream
      16.x fix)
    - performance note: a request passing checkServerIdentity in its own
      options now gets a private agent pool bucket, resumes no TLS session
      and has its socket destroyed rather than kept alive, so it pays a full
      handshake every time and no longer pools. Configuring
      checkServerIdentity on the Agent instead keeps the previous pooling
      and session-resumption behaviour
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 26 Aug 2026 12:00:00 +0000


alt-nodejs16-nodejs (16.20.2-25) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in http.Agent
    - debian/patches/CVE-2026-48931.patch: guard idle keep-alive sockets parked
      in the http.Agent freeSockets pool by swapping the handle's onread
      callback for freeSocketOnReadGuard (installFreeSocketDataGuard) and
      restoring it in reuseSocket, so unsolicited data arriving while the
      HTTPParser is detached destroys the socket instead of being consumed as
      the response to the next request that reuses it; includes the upstream
      follow-up that keeps the guard off the public stream to avoid the
      ERR_STREAM_PREMATURE_CLOSE keep-alive regression (no upstream Node.js 16
      fix exists - 16.x went EOL before disclosure; adapted from 0a22d40180,
      first in v22.23.0, plus eaa292549e, first in v22.23.1)
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after GOAWAY on invalid
    protocol errors
    - debian/patches/CVE-2026-48937.patch: detect in Http2Session::OnFrameSent
      a GOAWAY that nghttp2 queued internally via
      nghttp2_session_terminate_session() (frame-size, padding or HPACK
      errors, for which nghttp2 invokes no callback), record it in a new
      internal_goaway_sent_ flag and raise NGHTTP2_ERR_PROTO at the end of
      SendPendingData() so JS tears the session down once the GOAWAY has been
      written; Http2Session::Goaway() sets goaway_initiated_ so an
      application-requested GOAWAY is never mistaken for an internal one,
      stopping the server from indefinitely accepting data on a session it has
      already abandoned (no upstream Node.js 16 fix exists - 16.x went EOL
      before disclosure; adapted from a1a5bb9683, first in v22.23.0, minus the
      IsGracefulCloseInitiated() guard that does not exist in 16.x)
    - CVE-2026-48937
  * BUILD FIX: js-native-api test fixture fails to compile with GCC 14
    - debian/patches/js-native-api-test-callback-signature.patch: backport of
      upstream 5b316fe43f, corrects DeleteImmediately() in
      test/js-native-api/test_reference_double_free to return napi_value as
      DECLARE_NODE_API_PROPERTY requires. GCC 14 promotes the resulting
      -Wincompatible-pointer-types to an error by default, which aborted
      'make test-only' before any test ran. Test-only change; no shipped
      binary is affected.

 -- Viktor Borzov <vborzov@cloudlinux.com>  Wed, 26 Aug 2026 12:00:00 +0000

alt-nodejs16-nodejs (16.20.2-24) stable; urgency=medium

  * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination
    in the bundled llhttp parser
    - debian/patches/CVE-2025-23167.patch: restore terminator validation in the
      loose (non-strict) state machine of the bundled llhttp, which Node compiles
      by default (LLHTTP_STRICT_MODE is never set). node-v16.20.2.tar.gz ships
      llhttp 6.0.11, but CVE-2024-22019.patch and CVE-2024-27982.patch earlier in
      this series rebase it to 6.1.1, so this patch is derived against — and must
      be applied after — that rebased parser: headers_almost_done,
      chunk_size_almost_done and the chunk_data_almost_done /
      chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after
      a CR instead of consuming any byte, and res_line_almost_done requires the LF
      after the response status line's CR, so a header block ending in "\r\n\rX"
      or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of
      silently swallowing the byte and parsing the bytes that follow as a second,
      smuggled request; each accept/reject edge was derived from the loose
      machine's own goto graph rather than by copying the strict machine's labels,
      which are not interchangeable between the two halves (no upstream Node.js 16
      fix exists — 16.x went EOL in 2023, and upstream fixed this by replacing the
      parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR
      nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2)
    - NOTE: llhttp 6.1.1 has no LENIENT_OPTIONAL_LF_AFTER_CR flag, so unlike
      upstream llhttp 9 this rejection is unconditional: --insecure-http-parser
      can no longer restore the previous lenient framing.
    - NOTE: deps/undici bundles a second, prebuilt-WASM llhttp with the same
      defect. It is not patchable from source here and is reachable only behind
      --experimental-fetch (off by default); tracked separately.
    - CVE-2025-23167

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Thu, 13 Aug 2026 12:00:00 +0000

alt-nodejs16-nodejs (16.20.2-23) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:33:06 +0400

alt-nodejs16-nodejs (16.20.2-22) stable; urgency=medium

  * SECURITY UPDATE: http2 client Out-of-Memory via unbounded ORIGIN frames
    (CVE-2026-48619) — a malicious HTTP/2 server can send an unlimited number
    of ORIGIN frames to a node:http2 client, appending origins to the session
    originSet with no bound
    - debian/patches/CVE-2026-48619.patch: backport of upstream c79968e108
      (first in v22.23.0), caps the client-side originSet (default 128,
      configurable via options.maxOriginSetSize) and destroys the session
      with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded (Node 16 is EOL, no
      upstream 16.x fix; vulnerable onOrigin() loop present)
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostname authority rebinding
    (CVE-2026-48930) — dns.lookup/dnsPromises.lookup and net.connect accepted
    hostnames with an embedded NUL byte, silently truncated by the
    NUL-terminated C resolver, so a validated hostname could resolve a
    different authority
    - debian/patches/CVE-2026-48930.patch: backport of upstream 7dafafa242
      (first in v22.23.0), adds validateStringWithoutNullBytes() and rejects
      embedded NUL bytes in the hostname / options.host arguments before they
      reach the C resolver
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto AES cipher output-length integer overflow
    (CVE-2026-48933) — AES_Cipher() computed the output buffer length as a
    signed int, so an input length near 2 GiB overflowed and aborted the
    process
    - debian/patches/CVE-2026-48933.patch: backport of upstream 98fbc89211
      (first in v22.23.0), adds the TryGetIntCipherOutputLength() guard in
      crypto_cipher.h and uses it in AES_Cipher() so oversized inputs fail
      cleanly instead of overflowing
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 12:00:00 +0000

alt-nodejs16-nodejs (16.20.2-21) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 Rapid Reset (CVE-2023-44487) — a peer can cause a
    denial of service by rapidly opening and cancelling HTTP/2 streams
    (HEADERS immediately followed by RST_STREAM) without bound; the flaw is in
    the bundled nghttp2 library (1.47.0)
    - debian/patches/CVE-2023-44487.patch: minimal backport of the upstream
      nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000
      rate=33/s) to deps/nghttp2; once the per-connection budget is exhausted
      a GOAWAY is sent. Cherry-pick of nghttp2 commit 72b4af6143 (shipped in
      1.57.0), no wholesale version bump (Node 16 went EOL before the upstream
      fix, so no fixed 16.x exists)
    - CVE-2023-44487

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 09 Jun 2026 10:00:00 +0000

alt-nodejs16-nodejs (16.20.2-20) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 9.4.146.26
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream Node.js 16 fix exists — 16.x
      went EOL before disclosure; this is an adapted reduced port, no
      rapidhash / HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 26 May 2026 13:00:00 +0000

alt-nodejs16-nodejs (16.20.2-19) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 14:30:00 +0200

alt-nodejs16-nodejs (16.20.2-18) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 08:16:37 +0000

alt-nodejs16-nodejs (16.20.2-17) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs16-nodejs (16.20.2-16) stable; urgency=medium

  * SECURITY UPDATE: undici predictable multipart/form-data boundary
    - debian/patches/CVE-2025-22150.patch: replace Math.random() with
      crypto.randomInt() for the boundary string in bundled undici
      (deps/undici/src/lib/fetch/body.js). Math.random() output is
      predictable from a few sampled values, allowing attackers who can
      observe multipart requests to attacker-controlled servers to tamper
      with subsequent requests to backend APIs.
    - CVE-2025-22150

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 09:31:15 +0200

alt-nodejs16-nodejs (16.20.2-15) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs16-nodejs (16.20.2-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that allowed JavaScript to control
      ArrayBuffer initialization via shared memory, preventing race condition
      that could expose uninitialized memory when using vm module with timeouts
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 22:40:00 +0000

alt-nodejs16-nodejs (16.20.2-11) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 06 Feb 2026 14:00:00 +0100

alt-nodejs16-nodejs (16.20.2-10) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs16-nodejs (16.20.2-9) stable; urgency=low

  * SECURITY UPDATE: Node.js undici cross-origin redirect vulnerability
    - debian/patches/CVE-2023-45143.patch: clear Cookie and Host headers on
      cross-origin redirects to prevent sensitive data leakage
    - CVE-2023-45143

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 17 Dec 2025 12:00:00 +0000

alt-nodejs16-nodejs (16.20.2-8) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 12 Dec 2025 10:00:00 +0000

alt-nodejs16-nodejs (16.20.2-7) stable; urgency=medium

  * SECURITY UPDATE: Node.js code injection names export
    - debian/patches/CVE-2023-39333.patch: implement the mechanism in
      createExport() that avoids JavaScript code injection
    - CVE-2023-39333

 -- Eugeniusz Jarocki <ejarocki@cloudlinux.com>  Mon, 08 Dec 2025 17:37:51 +0000

alt-nodejs16-nodejs (16.20.2-6) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 03 Dec 2025 14:00:00 +0000

alt-nodejs16-nodejs (16.20.2-5) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 02 Dec 2025 18:43:54 +0000

alt-nodejs16-nodejs (16.20.2-4) stable; urgency=medium

  * Fix build for Ubuntu24.04

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Tue, 02 Dec 2025 13:01:00 +0400

alt-nodejs16-nodejs (16.20.2-3) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      to prevent forged checksums and tampering with Hash class internals
      in the policy mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 05 Nov 2025 10:19:25 -0500

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els3) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 14 Oct 2025 13:23:49 -0400

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 03 Oct 2025 09:58:29 +0000

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els3) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException()
    call in background thread to prevent process crash
    - CVE-2025-23166

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 23 Sep 2025 12:57:38 -0400

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 19 Sep 2025 11:17:03 +0000

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 08 Sep 2025 13:35:57 +0000

alt-nodejs16-nodejs (16.20.2-1) stable; urgency=medium

  * ALTNJS-125: Update to 16.20.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 01 Nov 2023 14:20:00 +0200

alt-nodejs16-nodejs (16.20.1-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
