alt-nodejs14-nodejs (14.21.3-21) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-19) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13
  * Use alt-libicu73 instead of alt-libicu71 on Debian >= 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 11 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-18) stable; urgency=high

  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466
  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 09 Feb 2026 14:00:00 +0100

alt-nodejs14-nodejs (14.21.3-17) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that could expose uninitialized
      memory when using vm module with timeout options
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 02 Feb 2026 22:00:00 +0000

alt-nodejs14-nodejs (14.21.3-16) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs14-nodejs (14.21.3-15) stable; urgency=high

  * ALTNJS-230: Added section in spec file for file conflict fix on updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Mon, 22 Dec 2025 12:00:00 +0400
 
alt-nodejs14-nodejs (14.21.3-14) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 12 Dec 2025 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-13) stable; urgency=high

  * ALTNJS-230: Fix error when updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 05 Dec 2025 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 03 Dec 2025 15:06:00 +0000
 
alt-nodejs14-nodejs (14.21.3-11) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 02 Dec 2025 14:43:54 +0000

alt-nodejs14-nodejs (14.21.3-10) stable; urgency=medium

  * Build for Ubuntu 24.04

    - debian/patches/add-cstdin-include.patch: add missing includes to v8 headers

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Mon, 01 Dec 2025 11:38:00 +0400

alt-nodejs14-nodejs (14.21.3-9) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      function to prevent tampering with Hash class internals in policy
      mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 19 Nov 2025 09:35:26 +0000

alt-nodejs14-nodejs (14.21.3-8) stable; urgency=high

  * ALTNJS-227: fix build for debian 12

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 17 Nov 2025 21:00:00 +0400

alt-nodejs14-nodejs (14.21.3-7) stable; urgency=high

  * SECURITY UPDATE: HTTP Request Smuggling vulnerability via empty headers separated by CR
    - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR
      in HTTP header fields, add lenient flag checks before allowing CR without LF,
      add test file to verify the fix prevents request smuggling attacks
    - CVE-2023-30589

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:48:05 +0000

alt-nodejs14-nodejs (14.21.3-6) stable; urgency=high

  * SECURITY UPDATE: A privilege escalation vulnerability in the experimental policy mechanism
    - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled,
      update deprecations and errors docs, add new test to ensure denial behavior,
      include new policy + app test fixtures
    - CVE-2023-32559

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:28:51 +0000

alt-nodejs14-nodejs (14.21.3-5) stable; urgency=high

  * SECURITY UPDATE: Node.js cryptographic vulnerability
    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 10:15:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els4) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 03 Nov 2025 13:30:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els3) stable; urgency=critical

  * SECURITY UPDATE: Node.js policy bypass vulnerabilities
    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 15 Oct 2025 11:27:51 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep 
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 06 Oct 2025 11:16:21 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.
  
 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 22 Sep 2025 11:13:25 +0000

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 10 Sep 2025 11:41:52 +0000

alt-nodejs14-nodejs (14.21.3-3) stable; urgency=medium

  * Fixed dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-2) stable; urgency=medium

  * ALTNJS-111: Fix non-functional npm

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-1) stable; urgency=medium

  * Update to 14.21.3 version

 -- CloudLinux Packaging Team <ssazonov@cloudlinux.comm>  Tue, 16 May 2023 07:02:37 +0000

alt-nodejs14-nodejs (14.21.2-1) stable; urgency=medium

  * update to 14.21.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 24 Jan 2023 14:20:00 +0200


alt-nodejs14-nodejs (14.20.1-1) stable; urgency=medium

  * update to 14.20.1 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 27 Sep 2022 13:50:00 +0200

alt-nodejs14-nodejs (14.20.0-2) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 07 Feb 2022 15:00:00 +0100
