alt-nodejs12-nodejs (12.22.12-20) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 21 May 2026 12:00:00 +0200

alt-nodejs12-nodejs (12.22.12-19) stable; urgency=medium

  * ALTNJS-254: Initial build for arm platforms
  * Use alt-libicu73 instead of alt-libicu71 on Debian >= 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 25 Mar 2026 12:00:00 +0400

alt-nodejs12-nodejs (12.22.12-17) stable; urgency=high

  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466
  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 10 Feb 2026 14:00:00 +0100

alt-nodejs12-nodejs (12.22.12-16) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that could expose uninitialized
      memory when using vm module with timeout options
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 17:30:00 +0000

alt-nodejs12-nodejs (12.22.12-15) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 05 Feb 2026 13:20:00 +0100

alt-nodejs12-nodejs (12.22.12-14) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 15 Dec 2025 11:00:00 +0000

alt-nodejs12-nodejs (12.22.12-13) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fix a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 09 Dec 2025 14:10:00 +0000

alt-nodejs12-nodejs (12.22.12-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 04 Dec 2025 15:54:00 +0000
 
alt-nodejs12-nodejs (12.22.12-11) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP parsing vulnerabilities
    - debian/patches/CVE-2022-32213-32214-32215-35256.patch: fix llhttp parser to properly
      validate HTTP headers and prevent request smuggling attacks:
      * CVE-2022-32213: fix missing CR validation in header separators to prevent
        HTTP request smuggling via malformed headers
      * CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
        and repeated chunked encoding values
      * CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
        attacks via conflicting encoding declarations
      * CVE-2022-35256: fix header overflow calculation to properly detect and
        reject oversized HTTP headers
    - CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-35256

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 01 Dec 2025 08:43:00 +0000

alt-nodejs12-nodejs (12.22.12-10) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 28 Nov 2025 16:50:00 +0000

alt-nodejs12-nodejs (12.22.12-9) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      function to prevent tampering with Hash class internals in policy
      mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 26 Nov 2025 15:50:51 +0000

alt-nodejs12-nodejs (12.22.12-8) stable; urgency=medium

  * Build for Ubuntu 20.04 / 22.04 / 24.04.

    - debian/patches/fix-cstdint-ubuntu24.patch: add a missing include in v8 header

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Tue, 25 Nov 2025 23:49:00 +0400

alt-nodejs12-nodejs (12.22.12-7) stable; urgency=medium

  * Fix build for debian 11.

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 24 Nov 2025 10:54:00 +0000

alt-nodejs12-nodejs (12.22.12-6) stable; urgency=high

  * SECURITY UPDATE: Node.js OS Command Injection vulnerability
    - debian/patches/CVE-2022-32212.patch: fix IPv4 validation in inspector_socket to properly
      validate IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable
      dot-counting parser with proper octet validation, add tests
    - CVE-2022-32212

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 20 Nov 2025 12:28:51 +0000

alt-nodejs12-nodejs (12.22.12-5) stable; urgency=medium

  * update version, add patches and logs for debian
  * SECURITY UPDATE: Node.js vulnerabilities

    - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR
      in HTTP header fields, add lenient flag checks before allowing CR without LF,
      add test file to verify the fix prevents request smuggling attacks
    - CVE-2023-30589

    - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled;
      update deprecations and errors docs and add new tests ensuring denial behavior
    - CVE-2023-32559

    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

    - debian/patches/CVE-2023-23918.patch: prevent process.mainModule.require()
      policy bypass
    - CVE-2023-23918

    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to prevent
      out-of-bounds read when parsing configuration files with embedded NULL characters
    - CVE-2024-25629

    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams during session
      destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 20 Nov 2025 08:51:00 +0000

alt-nodejs12-nodejs (12.22.12-4) stable; urgency=medium

  * ALTNJS-229: Build for debian 12.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 19 Nov 2025 14:20:00 +0200

alt-nodejs12-nodejs (12.22.12-2) stable; urgency=medium

  * ALTNJS-223: initial build for Debian.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 05 Nov 2025 14:20:00 +0200
