alt-nodejs23 (23.11.1-22) stable; urgency=medium

  * SECURITY UPDATE: Permission Model file-system allow-list bypass via radix
    tree split nodes (CVE-2026-58043)
    - FSPermission::RadixTree::Node::CreateChild() unconditionally set
      child->is_leaf = true on the post-loop fallthrough whenever a newly
      inserted --allow-fs-read/--allow-fs-write path shared the whole (or a
      shorter) stored prefix of an existing tree node. That node is not
      necessarily something the caller ever explicitly granted: repeatedly
      inserting sibling paths that share a leading substring (for example
      /tmp/secret1, /tmp/secret2, /tmp/secret3) makes CreateChild() synthesize
      an intermediate node holding just the shared substring ("secret") as
      pure trie bookkeeping, with is_leaf left false; the vulnerable
      fallthrough could then mark that synthetic node itself as a granted
      leaf, so /tmp/secret became readable/writable even though it was never
      passed to --allow-fs-read/--allow-fs-write
    - debian/patches/CVE-2026-58043.patch: capture whether a node already
      qualified as an end node before CreateChild() walks through it, and only
      propagate is_leaf = true on the fallthrough when it already did; also
      tighten the loop's own split-boundary check from `i > prefix_len` to
      `i >= prefix_len` so a newly-inserted path shorter than the existing
      child's stored prefix is unambiguously treated as its own split point
      (upstream 440329f6247c, single commit shared by v22.23.2, v24.18.1 and
      v26.5.1; carried verbatim, zero adaptation needed for 23.11.1)
    - CVE-2026-58043

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Tue, 08 Sep 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-21) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks retained by open streams escape the
    maxSessionMemory budget, allowing remote memory exhaustion
    (CVE-2026-56846)
    - Http2Session::HandleHeadersFrame() moved the decoded header block into
      JS and then immediately called DecrementCurrentSessionMemory(
      stream->current_headers_length_), un-charging every octet from the
      session's accounting even though the JS objects it just handed out can
      stay reachable for the whole lifetime of the Http2Stream. Since
      Http2Session::AddStream() only rejects new streams once
      current_session_memory_ crosses max_session_memory_, a peer that opens
      many streams, sends a large header block on each, and never lets them
      complete (for example by advertising initialWindowSize 0) accumulates
      unbounded header memory while the session reports near zero, so
      maxSessionMemory gives no protection against the largest contributor to
      that memory and the process can be driven to OOM by an
      unauthenticated remote peer
    - debian/patches/CVE-2026-56846.patch: adds a new Http2Stream field
      retained_headers_length_ that accumulates the header octets instead of
      decrementing them, so they stay charged while they can still be alive;
      drains both current_headers_length_ and retained_headers_length_ in
      Http2Session::RemoveStream(), each guarded by > 0 and zeroed after, so
      header memory is released exactly when the stream that can reach it
      goes away. The src/ hunks are carried verbatim from upstream
      f14d78b9e020 (v22.23.2; equivalent to 34ed88a06939 in v24.18.1) and
      needed no adaptation for 23.11.1. The upstream regression test
      test/parallel/test-http2-max-session-memory-stalled-headers.js is also
      carried, but adapted, with two deliberate deviations: its header block
      is built as an object with a multi-valued cookie field, because
      Http2Session#request() rejects the flat array upstream passes and would
      throw before the fix was ever exercised; and the test server raises
      maxHeaderListPairs to 4096, so that the pair-count branch of
      Http2Stream::AddHeader() cannot be what the test ends up measuring. The
      upstream doc/api/http2.md wording update is deliberately not carried,
      so the -doc sub-package's maxSessionMemory description does not yet
      mention header blocks retained by open streams
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 re-entrant nghttp2 send during an active receive
    causes a heap use-after-free (CVE-2026-56848)
    - Http2Stream::SubmitRstStream() deferred the frame only for
      NGHTTP2_CANCEL when nghttp2 was already inside a callback. For every
      other code -- including NGHTTP2_REFUSED_STREAM, which Node submits for
      any stream opened after a GOAWAY has set last_stream_id below that
      stream's id -- it fell through to session_->SendPendingData(), driving
      nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on
      the stack. The send pass can close streams and free the nghttp2_stream
      and Http2Stream state the suspended receive still points into; when the
      receive resumes it dereferences freed memory. Reachable from a raw
      socket with SETTINGS, HEADERS on stream 1, then GOAWAY(last_stream_id=0)
      immediately followed by HEADERS for streams 3, 5 and 7, with no
      authentication and no application cooperation
    - debian/patches/CVE-2026-56848.patch: adds a second in-scope guard,
      right after the existing NGHTTP2_CANCEL one, that calls
      FlushRstStream() and returns for NGHTTP2_REFUSED_STREAM, so the
      RST_STREAM is only queued (and flushed when the outer scope unwinds)
      instead of forcing a purge that re-enters nghttp2. Also carries the
      upstream regression test
      test/parallel/test-http2-rst-stream-reentrancy.js verbatim (upstream
      daa6d25e3dce, v22.23.2; identical insertion in ba6cb5c34c22,
      a77c7f7354c9 and 23b94c843ae0 for main, v24.18.1 and v26.5.1; the
      commit's cosmetic re-indent of the pre-existing AddPendingRstStream
      block deliberately omitted)
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-20) stable; urgency=medium

  * resync the alt-nodejs23-npm changelog with the package revision: the npm
    changelog was left at 10.9.2-23.11.1.17 while debian/changelog had advanced
    to 23.11.1-19, so the npm binary package shipped a revision suffix that no
    longer matched the runtime it ships with. Both changelogs are bumped to
    revision 20 rather than only fast-forwarding the npm one, because an
    out-of-sync revision has already been released, so the npm version has to
    move forward on a revision that is still free
  * buildsys-pre-build: assert that the revision suffix in
    debian/alt-nodejs*-npm.changelog matches the debian/changelog version, not
    just that the npm upstream version matches deps/npm/package.json, so a
    forgotten npm changelog bump fails the build instead of silently shipping a
    stale npm revision

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 26 Aug 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-19) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:39:40 +0400

alt-nodejs23 (23.11.1-18) stable; urgency=medium

  * SECURITY UPDATE: HTTPS identity-check bypass via Agent connection and TLS
    session reuse (CVE-2026-58040)
    - incomplete-fix follow-up to CVE-2026-48934: lib/https.js never referenced
      checkServerIdentity, so Agent.prototype.getName() did not key on it and
      two requests differing only in their per-request checkServerIdentity
      callback shared one agent key and one keep-alive socket pool;
      createConnection() cached and replayed TLS sessions purely on
      options._agentKey; and there was no keepSocketAlive override, so a socket
      approved by one request's callback stayed in the free pool. Since
      onConnectSecure() skips checkServerIdentity() when isSessionReused() is
      true, a connection authorized by a permissive callback could be resumed or
      its socket reused by a later request whose own callback would have
      rejected that peer
    - debian/patches/CVE-2026-58040.patch: tag a request carrying a per-request
      checkServerIdentity with a monotonic kPerRequestCheckServerIdentity index,
      append it in getName() so the request gets its own agent-key bucket, skip
      both the session lookup and the session cache for such requests, and add a
      keepSocketAlive() override that refuses to park the marked socket in the
      free pool; an Agent-level checkServerIdentity stays reuse-eligible
      (upstream 52a8ace880db, v22.x sibling 51123159fe86, with its regression
      test; upstream's establishTunnel() hunk dropped as 23.11.1 predates the
      built-in proxy support)
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 13 Aug 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-17) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass via process.report.writeReport()
    path misvalidation (CVE-2026-48617)
    - a process confined by --permission/--experimental-permission with
      --allow-fs-write could still write a diagnostic report outside the
      permitted set, because writeReport() consulted no permission gate
    - debian/patches/CVE-2026-48617.patch: gate writeReport() on
      permission.has('fs.write', file ?? process.cwd()) and throw
      ERR_ACCESS_DENIED on refusal (upstream 2f62693801, applies verbatim)
    - CVE-2026-48617
  * SECURITY UPDATE: Unicode dot separator TLS wildcard-depth authentication
    bypass (CVE-2026-48618)
    - checkServerIdentity() split the hostname on the ASCII dot only, while the
      resolver applies IDNA mapping that also treats U+3002, U+FF0E and U+FF61
      as label separators, so foo<U+3002>bar.example.com connected as four
      labels but was verified as three and a *.example.com certificate
      authenticated a host two levels below it
    - debian/patches/CVE-2026-48618.patch: derive
      unfqdn(domainToASCII(hostname)) and feed it to splitHost() (upstream
      2197a47144), plus the mandatory IPv6 IP-SAN follow-up 1d87a240505 without
      which IPv6 hosts stop matching their IP Address SANs
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching mTLS authorization
    bypass (CVE-2026-48928)
    - Server.prototype.addContext() compiled the servername into a RegExp with
      no flags, so an uppercase or mixed-case SNI name missed its per-hostname
      SecureContext and the handshake fell back to the default context,
      bypassing per-tenant client-CA/requestCert policy
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to that RegExp
      (upstream 39d1d09684) as RFC 6066 s3 requires
    - CVE-2026-48928
  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in
    http.Agent (CVE-2026-48931)
    - a keep-alive socket parked in the Agent freeSockets pool had the
      HTTPParser detached and no reader attached, so unsolicited bytes written
      by a hostile peer stayed queued and were parsed as the response to the
      next request that reused the socket; on 23.x the default http/https
      globalAgent is keepAlive:true, so no opt-in is required
    - debian/patches/CVE-2026-48931.patch: install a libuv-handle-level read
      guard on idle pooled sockets and destroy any socket that receives data
      while idle (upstream 0a22d40180 plus the mandatory follow-up eaa292549e,
      which moves the guard off the public 'data' listener that caused
      ERR_STREAM_PREMATURE_CLOSE regressions)
    - CVE-2026-48931
  * SECURITY UPDATE: TLS host verification bypass via session reuse
    (CVE-2026-48934)
    - onConnectSecure() skips checkServerIdentity() when the session is reused,
      and a client session carried no record of the host it was authenticated
      for, so a session from host A could be replayed against host B and the
      connection reported authorized against an unchecked certificate
    - debian/patches/CVE-2026-48934.patch: wrap emitted/returned sessions with
      the authenticated servername and reject a session offered for a different
      host, and make getSession() a real method instead of a raw handle proxy
      (upstream fd890ba01d, with the regression tests from 1662a3ea09)
    - CVE-2026-48934
  * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes()
    (CVE-2026-48935)
    - FileHandle.prototype.utimes() -> futimes() in the fs/promises API carried
      no permission gate, so a process confined with --permission and only
      --allow-fs-read could still mutate a file's atime/mtime; this is the
      promises-API half left ungated by CVE-2025-55132
    - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from
      futimes() when permission.isEnabled(), matching the existing fchmod() and
      fchown() guards in the same file (upstream a929332960)
    - CVE-2026-48935
  * SECURITY UPDATE: HTTP/2 sessions never clean up after an nghttp2-internal
    GOAWAY (CVE-2026-48937)
    - when nghttp2 hits a protocol error before reading a frame payload
      (oversized frame header, padding error, HPACK failure) it calls
      nghttp2_session_terminate_session() directly, which queues a GOAWAY but
      invokes no callback, so Node emitted no 'error', never destroyed the
      Http2Session, never closed the socket and kept consuming everything the
      peer sent -> unauthenticated remote resource exhaustion
    - debian/patches/CVE-2026-48937.patch: add internal_goaway_sent_ /
      goaway_initiated_ flags, set the former in OnFrameSent() for a GOAWAY the
      application did not initiate and raise NGHTTP2_ERR_PROTO at the end of
      SendPendingData() (functional src/ hunks of upstream a1a5bb9683; the
      bundled nghttp2 is not bumped, so the two flow-control test re-baselines
      are omitted, and the !IsGracefulCloseInitiated() sub-condition is dropped
      as that accessor does not exist on this line)
    - CVE-2026-48937

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 10 Aug 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-16) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    (CVE-2026-48619)
    - a malicious HTTP/2 server could send an unlimited number of ORIGIN
      frames to a node:http2 client; onOrigin() appended every origin to the
      session originSet in an unbounded loop -> Out-of-Memory / remote DoS
    - debian/patches/CVE-2026-48619.patch: cap the originSet at 128 entries
      (kMaxOriginSetSize, configurable via connect() maxOriginSetSize) and
      destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once the cap is
      reached (functional hunks of upstream c79968e108; 23.x is EOL with no
      upstream release carrying it)
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostname authority rebinding (CVE-2026-48930)
    - dns.lookup/dnsPromises.lookup/net.connect accepted hostnames with an
      embedded NUL byte; the C resolver truncates at the first NUL, so a
      JS-validated hostname could resolve/connect to a different authority
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      in lib/internal/validators.js and apply it to the hostname/options.host
      arguments in lib/dns.js, lib/internal/dns/promises.js and lib/net.js
      (JS-only fix, functional hunks of upstream 7dafafa2; 23.x is EOL)
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto AES cipher output-length integer overflow
    (CVE-2026-48933)
    - AES_Cipher() computed the output buffer length as a signed int
      (in.size() + block size + tag), which overflows at ~2 GiB input and
      aborts the process (subtle.encrypt) -> DoS (CWE-190)
    - debian/patches/CVE-2026-48933.patch: add the TryGetIntCipherOutputLength
      guard in src/crypto/crypto_cipher.h and apply it to the AES_Cipher()
      length computation in src/crypto/crypto_aes.cc (adapted from upstream
      98fbc89211 to the 23.11.1 in.size()/tag_len form; the absent
      crypto_chacha20_poly1305.cc hunk is omitted; 23.x is EOL)
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-15) stable; urgency=medium

  * SECURITY UPDATE: memory leak in Node.js OpenSSL integration (CVE-2025-59464)
    - X509Name::Iterator::operator*() allocated a UTF-8 buffer via
      ASN1_STRING_to_UTF8() for each X.509 name field and returned without
      freeing it; reachable from JS via socket.getPeerCertificate(true), a
      remote peer opening repeated TLS connections drives unbounded memory
      growth -> remote Denial of Service
    - debian/patches/CVE-2025-59464.patch: copy the converted buffer into a
      local std::string and OPENSSL_free() it before returning (matches the
      upstream fix present in node >= 24.12.0; 23.x is EOL with no upstream
      release carrying it)
    - CVE-2025-59464

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 09 Jun 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-14) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance ~440x in a local PoC against V8 12.9.202.28
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's raw_hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream V8 12.9 backport exists; this
      is an adapted reduced port — no rapidhash/HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 25 May 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-13) stable; urgency=medium

  * SECURITY UPDATE: incomplete fix for CVE-2024-36137 left FileHandle.chmod()
    and FileHandle.chown() in the promise-based fs API without permission checks
    - debian/patches/CVE-2026-21716.patch: add permission check on lib/fs/promises
      so FileHandle.chmod, FileHandle.chown and fsPromises.lstat enforce the
      Permission Model under --allow-fs-write / --allow-fs-read restrictions
    - CVE-2026-21716

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Thu, 21 May 2026 14:00:00 +0200

alt-nodejs23 (23.11.1-12) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 12:00:00 +0200

alt-nodejs23 (23.11.1-11) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 14:35:00 +0200

alt-nodejs23 (23.11.1-10) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass in fs.realpath.native
    - debian/patches/CVE-2026-21715.patch: add permission check to
      realpath.native in src/node_file.cc so --allow-fs-read is enforced
      and prevents filesystem enumeration outside permitted directories
    - CVE-2026-21715

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 19 May 2026 13:30:00 +0200

alt-nodejs23 (23.11.1-9) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 18 May 2026 16:15:00 +0200

alt-nodejs23 (23.11.1-8) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs23 (23.11.1-7) stable; urgency=medium

  * ELS-2134: Enable internal tests on Debian 13 builds

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 17 Mar 2026 12:00:00 +0100

alt-nodejs23 (23.11.1-6) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs23 (23.11.1-5) stable; urgency=medium

  * SECURITY UPDATE: File descriptor metadata bypass in permission model
    - debian/patches/CVE-2025-55132.patch: disable futimes, fdatasync, and
      fsync APIs when permission model is enabled to prevent metadata updates
      via read-only file descriptors
    - CVE-2025-55132

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 10 Feb 2026 14:00:00 +0000

alt-nodejs23 (23.11.1-4) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback
      invocations in try-catch blocks to route exceptions through error
      handlers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 05 Feb 2026 12:45:00 +0000

alt-nodejs23 (23.11.1-3) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle in lib/internal/buffer.js, src/node_buffer.cc,
      src/api/environment.cc, and src/node_internals.h
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 02 Feb 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-2) stable; urgency=medium

  * SECURITY UPDATE: Symlink permission bypass vulnerability
    - debian/patches/CVE-2025-55130.patch: require full read and write fs
      permissions for symlink APIs to prevent permission model bypass
    - CVE-2025-55130
  * SECURITY UPDATE: Unhandled rejection in TLS socket error handling
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs23 (23.11.1-1) stable; urgency=medium

  * ALTNJS-231: Update tarball to 23.11.1 version.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 02 Dec 2025 01:12:00 +0400

alt-nodejs23 (23.2.0-1) stable; urgency=medium

  * ALTNJS-225: Initial build.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 13 Nov 2025 16:30:00 +0400
