alt-nodejs23 (23.11.1-15) stable; urgency=medium

  * SECURITY UPDATE: memory leak in Node.js OpenSSL integration (CVE-2025-59464)
    - X509Name::Iterator::operator*() allocated a UTF-8 buffer via
      ASN1_STRING_to_UTF8() for each X.509 name field and returned without
      freeing it; reachable from JS via socket.getPeerCertificate(true), a
      remote peer opening repeated TLS connections drives unbounded memory
      growth -> remote Denial of Service
    - debian/patches/CVE-2025-59464.patch: copy the converted buffer into a
      local std::string and OPENSSL_free() it before returning (matches the
      upstream fix present in node >= 24.12.0; 23.x is EOL with no upstream
      release carrying it)
    - CVE-2025-59464

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 09 Jun 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-14) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance ~440x in a local PoC against V8 12.9.202.28
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's raw_hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream V8 12.9 backport exists; this
      is an adapted reduced port — no rapidhash/HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 25 May 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-13) stable; urgency=medium

  * SECURITY UPDATE: incomplete fix for CVE-2024-36137 left FileHandle.chmod()
    and FileHandle.chown() in the promise-based fs API without permission checks
    - debian/patches/CVE-2026-21716.patch: add permission check on lib/fs/promises
      so FileHandle.chmod, FileHandle.chown and fsPromises.lstat enforce the
      Permission Model under --allow-fs-write / --allow-fs-read restrictions
    - CVE-2026-21716

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Thu, 21 May 2026 14:00:00 +0200

alt-nodejs23 (23.11.1-12) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 12:00:00 +0200

alt-nodejs23 (23.11.1-11) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 14:35:00 +0200

alt-nodejs23 (23.11.1-10) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass in fs.realpath.native
    - debian/patches/CVE-2026-21715.patch: add permission check to
      realpath.native in src/node_file.cc so --allow-fs-read is enforced
      and prevents filesystem enumeration outside permitted directories
    - CVE-2026-21715

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 19 May 2026 13:30:00 +0200

alt-nodejs23 (23.11.1-9) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 18 May 2026 16:15:00 +0200

alt-nodejs23 (23.11.1-8) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs23 (23.11.1-7) stable; urgency=medium

  * ELS-2134: Enable internal tests on Debian 13 builds

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 17 Mar 2026 12:00:00 +0100

alt-nodejs23 (23.11.1-6) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs23 (23.11.1-5) stable; urgency=medium

  * SECURITY UPDATE: File descriptor metadata bypass in permission model
    - debian/patches/CVE-2025-55132.patch: disable futimes, fdatasync, and
      fsync APIs when permission model is enabled to prevent metadata updates
      via read-only file descriptors
    - CVE-2025-55132

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 10 Feb 2026 14:00:00 +0000

alt-nodejs23 (23.11.1-4) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback
      invocations in try-catch blocks to route exceptions through error
      handlers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 05 Feb 2026 12:45:00 +0000

alt-nodejs23 (23.11.1-3) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle in lib/internal/buffer.js, src/node_buffer.cc,
      src/api/environment.cc, and src/node_internals.h
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 02 Feb 2026 12:00:00 +0000

alt-nodejs23 (23.11.1-2) stable; urgency=medium

  * SECURITY UPDATE: Symlink permission bypass vulnerability
    - debian/patches/CVE-2025-55130.patch: require full read and write fs
      permissions for symlink APIs to prevent permission model bypass
    - CVE-2025-55130
  * SECURITY UPDATE: Unhandled rejection in TLS socket error handling
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs23 (23.11.1-1) stable; urgency=medium

  * ALTNJS-231: Update tarball to 23.11.1 version.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 02 Dec 2025 01:12:00 +0400

alt-nodejs23 (23.2.0-1) stable; urgency=medium

  * ALTNJS-225: Initial build.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 13 Nov 2025 16:30:00 +0400
