alt-nodejs20-nodejs (20.20.2-13) stable; urgency=medium

  * SECURITY UPDATE: under --experimental-permission, enabling trace events
    starts the tracing agent, which creates and truncates the file named by
    --trace-event-file-pattern without any FileSystemWrite check, so a
    process with no fs.write grant for that path can still write there
    (CVE-2026-56847)
    - debian/patches/CVE-2026-56847.patch: lift the ${pid}/${rotation}
      substitution out of NodeTraceWriter::OpenNewFileForStreaming() into a
      new static NodeTraceWriter::GetFilePath(), and use it in
      NodeCategorySet::Enable() to resolve the configured pattern and run
      the resulting path through THROW_IF_INSUFFICIENT_PERMISSIONS before
      the tracing agent is started. Also adds the upstream regression test
      test/parallel/test-permission-fs-write-trace-events.js
    - CVE-2026-56847

  * SECURITY UPDATE: process.report.writeReport() checks the permission of
    the bare filename and of the cwd, but writes to report.directory joined
    with that filename, so under --experimental-permission a report can be
    created or truncated in a directory the process was never granted
    (CVE-2026-58039)
    - debian/patches/CVE-2026-58039.patch: hoist the report_directory and
      filename join in TriggerNodeReport() into a `pathname` local and move
      the FileSystemWrite check to after it, immediately before the file is
      opened, so the path that is checked is the path that is written; and
      prepend nr.getDirectory() to the resource the JavaScript gate in
      lib/internal/process/report.js tests. Also adds the upstream
      regression hunks to test/parallel/test-permission-fs-write-report.js
    - CVE-2026-58039

  * SECURITY UPDATE: server.maxHeadersCount was applied only after parsing,
    by truncating the header list handed to JavaScript, while llhttp kept
    parsing and honouring every header it saw, so a request with more
    header pairs than the limit could be framed by Content-Length or
    Transfer-Encoding headers the application never sees -- a request
    smuggling and header-check bypass primitive (CVE-2026-58044)
    - debian/patches/CVE-2026-58044.patch: add a header_pairs_ counter and
      a TrackHeaderPair() check to the C++ Parser, called from
      on_header_field and reset with the rest of the per-message state, so
      exceeding the parser's maxHeaderPairs sets the llhttp error reason to
      HPE_HEADER_OVERFLOW and returns HPE_USER, rejecting the request
      instead of silently truncating it. Also adds the upstream regression
      test test/parallel/test-http-max-headers-count-overflow.js and the
      updated test-http-max-headers-count.js / test-https-max-headers-count.js
    - CVE-2026-58044

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 05 Oct 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-12) stable; urgency=medium

  * ALTNJS-295: derive the alt-nodejs20-npm package version from the bundled
    npm version and debian/changelog in debian/rules, so every Debian revision
    bump also changes the npm package version. Up to now it came only from
    debian/alt-nodejs20-npm.changelog, and the Debian rebuild in build
    6a8cac054c34bf1292240b1a re-shipped the npm package under its previous
    version with different contents.

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 05 Oct 2026 18:37:13 +0400

alt-nodejs20-nodejs (20.20.2-11) stable; urgency=medium

  * SECURITY UPDATE: https.Agent socket-pool names built from a `pfx` array of
    { buf, passphrase } objects collapse to the literal `[object Object]`, so
    requests configured with different mTLS client certificates share one pool
    entry and can reuse each other's authenticated socket or TLS session
    (CVE-2026-56850)
    - debian/patches/CVE-2026-56850.patch: add getPfxAgentKey() to
      lib/https.js and route the `pfx` leg of Agent.prototype.getName()
      through it, so an array-valued `pfx` contributes each entry's raw
      certificate buffer and its effective passphrase to the pool name; a
      non-array `pfx` keeps the name it had. Also adds the upstream
      regression tests test/parallel/test-https-agent-getname.js (new
      assertions) and test/parallel/test-https-agent-pfx-object-array-reuse.js
    - CVE-2026-56850

  * SECURITY UPDATE: dns.resolveAny() aborts the process when a DNS reply
    carries more than 256 A records, which a hostile or merely large
    authoritative answer can trigger repeatedly for a denial of service
    (CVE-2026-58042)
    - debian/patches/CVE-2026-58042.patch: in src/cares_wrap.cc, replace the
      fixed ares_addrttl[256] / ares_addr6ttl[256] TTL buffers with
      std::vectors sized from the reply's ANCOUNT via the new
      GetAnswerCountForTTLBuffer() and MakeAddrTTLBuffer() helpers, so
      naddrttls can no longer come back clamped below the record count and
      trip CHECK_EQ(naddrttls, a_count); also adds the regression test
      test/parallel/test-dns-resolveany-ttl-overflow.js
    - CVE-2026-58042

  * SECURITY UPDATE: the synchronous node:zlib entry points abort the process
    when handed a TypedArray whose byteLength is spoofed with a getter, which
    can be repeated for a denial of service (CVE-2026-58045)
    - debian/patches/CVE-2026-58045.patch: in src/node_zlib.cc, turn the two
      CHECK(Buffer::IsWithinBounds(...)) assertions in
      CompressionStream::Write() into THROW_ERR_OUT_OF_RANGE() so an
      out-of-bounds input or output buffer raises a catchable RangeError with
      code ERR_OUT_OF_RANGE instead of aborting; also adds the upstream
      regression assertions to test/parallel/test-zlib-invalid-input.js
    - CVE-2026-58045

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-10) stable; urgency=medium

  * SECURITY UPDATE: Permission Model allow-list radix tree grants an
    unlisted sibling path when three or more --allow-fs-read /
    --allow-fs-write entries share a common prefix
    - debian/patches/CVE-2026-58043.patch: in
      FSPermission::RadixTree::Node::CreateChild(), stop unconditionally
      marking an internal split node as an explicit leaf when a new,
      longer allow-list entry is inserted past it, so a node created only
      to branch to more specific sibling entries (e.g. secret1, secret2,
      secret3) no longer becomes an implicitly granted path of its own
      (e.g. secret)
    - CVE-2026-58043

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Tue, 08 Sep 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-9) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks handed to JS stop being charged
    against maxSessionMemory while they can still be kept alive, letting a
    remote peer exhaust memory with many stalled streams carrying large
    header blocks (CVE-2026-56846)
    - debian/patches/CVE-2026-56846.patch: add a second per-stream counter
      Http2Stream::retained_headers_length_ in src/node_http2.h, move
      current_headers_length_ into it in Http2Session::HandleHeadersFrame()
      instead of calling DecrementCurrentSessionMemory() there, and drain
      both counters from the session total in Http2Session::RemoveStream()
      so the header memory is un-charged only once the stream is gone;
      also adds the upstream regression test
      test/parallel/test-http2-max-session-memory-stalled-headers.js,
      adapted in two ways: the header block is built as an object with a
      multi-valued cookie field because Http2Session#request() rejects
      upstream's flat header array, and the server is created with
      maxHeaderListPairs raised to 4096 so AddHeader()'s pair-count
      branch cannot be what the test measures, leaving the
      session-memory branch as the only route
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 heap use-after-free when RST_STREAM is submitted
    for a refused stream from inside an nghttp2 receive callback, which
    re-enters nghttp2's send path and frees streams the active receive is
    still using (CVE-2026-56848)
    - debian/patches/CVE-2026-56848.patch: in
      Http2Stream::SubmitRstStream() (src/node_http2.cc), defer the reset
      when Http2Session::is_in_scope() and the code is
      NGHTTP2_REFUSED_STREAM by calling FlushRstStream() and returning,
      instead of falling through to the SendPendingData() force purge;
      also adds the upstream regression test
      test/parallel/test-http2-rst-stream-reentrancy.js
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-8) stable; urgency=medium

  * SECURITY UPDATE: HTTPS identity check not bound to connection or TLS
    session reuse (incomplete fix for CVE-2026-48934)
    - debian/patches/CVE-2026-58040.patch: tag request options in
      https.request() with a per-request kPerRequestCheckServerIdentity symbol
      when the caller supplies its own checkServerIdentity and the Agent was
      not constructed with one, key Agent.prototype.getName() on that tag,
      skip both the TLS session resume and the session caching listener in
      createConnection() for tagged requests, and add an
      Agent.prototype.keepSocketAlive() override in lib/https.js that refuses
      to park such a socket in freeSockets
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-7) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:39:40 +0400

alt-nodejs20-nodejs (20.20.2-6) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass via process.report.writeReport()
    path misvalidation
    - debian/patches/CVE-2026-48617.patch: gate writeReport() in
      lib/internal/process/report.js on permission.has('fs.write', ...) for
      the supplied file or the current working directory, throwing
      ERR_ACCESS_DENIED instead of writing a diagnostic report outside the
      --allow-fs-write allow-list
    - CVE-2026-48617
  * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() in the
    promises API
    - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from
      futimes() in lib/internal/fs/promises.js when the Permission Model is
      enabled, so file timestamps can no longer be modified through a
      read-only FileHandle
    - CVE-2026-48935

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 14:00:00 +0000

alt-nodejs20-nodejs (20.20.2-5) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in
    http.Agent
    - debian/patches/CVE-2026-48931.patch: install a libuv handle-level read
      guard (installFreeSocketDataGuard / freeSocketOnReadGuard) on sockets
      parked in the freeSockets pool in lib/_http_agent.js and remove it in
      Agent.prototype.reuseSocket(), destroying any idle pooled socket that
      receives unsolicited data
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after an internal GOAWAY
    - debian/patches/CVE-2026-48937.patch: detect an nghttp2-initiated GOAWAY
      in Http2Session::OnFrameSent() and raise NGHTTP2_ERR_PROTO at the end of
      Http2Session::SendPendingData() in src/node_http2.cc, with the new
      goaway_initiated_ / internal_goaway_sent_ flags in src/node_http2.h, so
      the session is destroyed instead of accepting data after a protocol
      error
    - CVE-2026-48937

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 13:00:00 +0000

alt-nodejs20-nodejs (20.20.2-4) stable; urgency=medium

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode
    dot separators
    - debian/patches/CVE-2026-48618.patch: normalize the hostname with
      domainToASCII() in lib/tls.js and feed the IDNA-normalized name to
      splitHost() in checkServerIdentity(), while still matching IP
      literals against the original hostname
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching allows mTLS
    authorization bypass
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the
      servername RegExp built by Server.prototype.addContext() in
      lib/_tls_wrap.js
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session
    reuse with a different servername
    - debian/patches/CVE-2026-48934.patch: bind client sessions to the
      authenticated host in lib/_tls_wrap.js (wrapSessionState /
      getSessionForReuse) and refuse to resume unbound or mismatched
      sessions
    - CVE-2026-48934

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-3) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the client-side originSet
      (maxOriginSetSize, default 128) in lib/internal/http2/core.js and
      destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      in lib/internal/validators.js and reject embedded-NUL hostnames in
      lib/dns.js, lib/internal/dns/promises.js and lib/net.js
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto cipher output-length integer overflow
    - debian/patches/CVE-2026-48933.patch: add TryGetIntCipherOutputLength
      in src/crypto/crypto_cipher.h and guard the AES_Cipher output length
      in src/crypto/crypto_aes.cc against signed int overflow
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 00:00:00 +0000

alt-nodejs20-nodejs (20.20.2-2) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 15:00:00 +0200

alt-nodejs20-nodejs (20.20.2-1) stable; urgency=medium

  * ALTNJS-253: Update to 20.20.2 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 24 Mar 2026 20:26:04 -0400

alt-nodejs20-nodejs (20.20.0-5) stable; urgency=medium

  * ALTNJS-254: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 25 Mar 2026 12:00:00 +0400

alt-nodejs20-nodejs (20.20.0-1) stable; urgency=medium

  * ALTNJS-236: update to 20.20.0

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Fri, 16 Jan 2026 14:00:00 +0400

alt-nodejs20-nodejs (20.19.4-2) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs20-nodejs (20.19.4-1) stable; urgency=medium

  * ALTNJS-218: update to 20.19.4

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 26 Aug 2025 23:00:00 +0400

alt-nodejs20-nodejs (20.19.3-1) stable; urgency=medium

  * ALTNJS-212: update to 20.19.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 07 Jul 2025 13:35:00 +0200  

alt-nodejs20-nodejs (20.19.2-1) stable; urgency=medium

  * ALTNJS-206: update to 20.19.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 02 Jun 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.3-1) stable; urgency=medium

  * ALTNJS-203: update to 20.18.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.2-1) stable; urgency=medium

  * ALTNJS-201: update to 20.18.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100  

alt-nodejs20-nodejs (20.18.1-1) stable; urgency=medium

  * ALTNJS-197: Update to 20.18.1 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 08 Jan 2025 16:00:00 +0100

alt-nodejs20-nodejs (20.17.0-1) stable; urgency=medium

  * ALTNJS-195: Update to 20.17.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 12 Sep 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.16.0-1) stable; urgency=medium

  * ALTNJS-194: Update to 20.16.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 12 Aug 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-1) stable; urgency=medium

  * ALTNJS-190: Update to 20.15.1 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 12 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.14.0-1) stable; urgency=medium

  * ALTNJS-188: Update to 20.14.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 11 Jun 2024 15:00:00 +0200

alt-nodejs20-nodejs (20.12.2-1) stable; urgency=medium

  * ALTNJS-177: Update to 20.12.2 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 12:25:00 +0200

alt-nodejs20-nodejs (20.12.0-1) stable; urgency=medium

  * ALTNJS-171: Update to 20.12.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 27 Mar 2024 15:00:00 +0100

alt-nodejs20-nodejs (20.10.0-1) stable; urgency=medium

  * ALTNJS-164: Update to 20.10.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 29 Nov 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.9.0-1) stable; urgency=medium

  * ALTNJS-161: Update to 20.9.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 30 Oct 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.6.1-1) stable; urgency=medium

  * Update to 20.6.1 version

 -- Release Scout <release-scout@cloudlinux.com>  Fri, 08 Sep 2023 18:23:15 +0000

alt-nodejs20-nodejs (20.6.0-1) stable; urgency=medium

  * Update to 20.6.0 version

 -- Release Scout <release-scout@cloudlinux.com>  Tue, 05 Sep 2023 07:29:09 +0000

alt-nodejs20-nodejs (20.5.0-1) stable; urgency=medium

  * Updated to 20.5.0

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 2 Aug 2023 15:00:00 +0200

alt-nodejs20-nodejs (20.4.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
