alt-nodejs14-nodejs (14.21.3-25) stable; urgency=high

  * SECURITY UPDATE: embedded-NUL hostnames -> silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: reject hostnames containing an
      embedded NUL byte in dns.lookup(), dnsPromises.lookup() and
      net.connect()/net.createConnection() before they reach the C resolver,
      which would otherwise truncate the string at the NUL and resolve/connect
      to a different authority than the one validated in JavaScript. Adds
      validateStringWithoutNullBytes() in lib/internal/validators.js (backport
      of nodejs/node@7dafafa2 adapted to 14.21.3)
    - CVE-2026-48930
  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the client-side originSet at a
      configurable maxOriginSetSize (default 128) in lib/internal/http2/core.js;
      a malicious server sending unlimited ORIGIN frames now trips
      ERR_HTTP2_TOO_MANY_ORIGINS instead of growing the set without bound
      (backport of nodejs/node@c79968e1)
    - CVE-2026-48619
  * SECURITY UPDATE: cipher output-length signed-int overflow (~2 GiB input)
    - debian/patches/CVE-2026-48933.patch: guard the len + block_size output
      length computation in CipherBase::Update (src/node_crypto.cc) against
      signed-int overflow that produced a bogus buffer size passed to
      EVP_CipherUpdate() -> OOB write / crash. Node 14 predates WebCrypto, so
      the INT_MAX guard from nodejs/node@98fbc892 is adapted to the legacy
      crypto.createCipheriv().update() path
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-24) stable; urgency=high

  * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__
    - debian/patches/CVE-2023-30581.patch: install the policy-aware require()
      on the module prototype and assign process.mainModule via
      setOwnProperty(), so process.mainModule.__proto__.require() can no
      longer escape the --experimental-policy manifest restrictions
    - CVE-2023-30581
  * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service
    - debian/patches/CVE-2023-44487.patch: backport the upstream nghttp2
      1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2
      1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM
      frames now tear the connection down with GOAWAY instead of doing
      unbounded per-stream work
    - CVE-2023-44487

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 09 Jun 2026 10:00:00 +0000

alt-nodejs14-nodejs (14.21.3-23) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 8.4.371.23
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream V8 8.4 backport exists; this
      is an adapted reduced port — no rapidhash/HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 22 May 2026 10:00:00 +0200

alt-nodejs14-nodejs (14.21.3-22) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 15:00:00 +0200

alt-nodejs14-nodejs (14.21.3-21) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-19) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13
  * Use alt-libicu73 instead of alt-libicu71 on Debian >= 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 11 Feb 2026 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-18) stable; urgency=high

  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466
  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 09 Feb 2026 14:00:00 +0100

alt-nodejs14-nodejs (14.21.3-17) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that could expose uninitialized
      memory when using vm module with timeout options
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 02 Feb 2026 22:00:00 +0000

alt-nodejs14-nodejs (14.21.3-16) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs14-nodejs (14.21.3-15) stable; urgency=high

  * ALTNJS-230: Added section in spec file for file conflict fix on updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Mon, 22 Dec 2025 12:00:00 +0400
 
alt-nodejs14-nodejs (14.21.3-14) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 12 Dec 2025 12:00:00 +0000

alt-nodejs14-nodejs (14.21.3-13) stable; urgency=high

  * ALTNJS-230: Fix error when updating

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 05 Dec 2025 12:00:00 +0400

alt-nodejs14-nodejs (14.21.3-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 03 Dec 2025 15:06:00 +0000
 
alt-nodejs14-nodejs (14.21.3-11) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 02 Dec 2025 14:43:54 +0000

alt-nodejs14-nodejs (14.21.3-10) stable; urgency=medium

  * Build for Ubuntu 24.04

    - debian/patches/add-cstdin-include.patch: add missing includes to v8 headers

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Mon, 01 Dec 2025 11:38:00 +0400

alt-nodejs14-nodejs (14.21.3-9) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      function to prevent tampering with Hash class internals in policy
      mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 19 Nov 2025 09:35:26 +0000

alt-nodejs14-nodejs (14.21.3-8) stable; urgency=high

  * ALTNJS-227: fix build for debian 12

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 17 Nov 2025 21:00:00 +0400

alt-nodejs14-nodejs (14.21.3-7) stable; urgency=high

  * SECURITY UPDATE: HTTP Request Smuggling vulnerability via empty headers separated by CR
    - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR
      in HTTP header fields, add lenient flag checks before allowing CR without LF,
      add test file to verify the fix prevents request smuggling attacks
    - CVE-2023-30589

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:48:05 +0000

alt-nodejs14-nodejs (14.21.3-6) stable; urgency=high

  * SECURITY UPDATE: A privilege escalation vulnerability in the experimental policy mechanism
    - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled,
      update deprecations and errors docs, add new test to ensure denial behavior,
      include new policy + app test fixtures
    - CVE-2023-32559

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 12:28:51 +0000

alt-nodejs14-nodejs (14.21.3-5) stable; urgency=high

  * SECURITY UPDATE: Node.js cryptographic vulnerability
    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 11 Nov 2025 10:15:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els4) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 03 Nov 2025 13:30:00 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els3) stable; urgency=critical

  * SECURITY UPDATE: Node.js policy bypass vulnerabilities
    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 15 Oct 2025 11:27:51 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep 
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 06 Oct 2025 11:16:21 +0000

alt-nodejs14-nodejs (14.21.3-4+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.
  
 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 22 Sep 2025 11:13:25 +0000

alt-nodejs14-nodejs (14.21.3-3+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 10 Sep 2025 11:41:52 +0000

alt-nodejs14-nodejs (14.21.3-3) stable; urgency=medium

  * Fixed dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-2) stable; urgency=medium

  * ALTNJS-111: Fix non-functional npm

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 May 2023 15:23:00 +0200 

alt-nodejs14-nodejs (14.21.3-1) stable; urgency=medium

  * Update to 14.21.3 version

 -- CloudLinux Packaging Team <ssazonov@cloudlinux.comm>  Tue, 16 May 2023 07:02:37 +0000

alt-nodejs14-nodejs (14.21.2-1) stable; urgency=medium

  * update to 14.21.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 24 Jan 2023 14:20:00 +0200


alt-nodejs14-nodejs (14.20.1-1) stable; urgency=medium

  * update to 14.20.1 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 27 Sep 2022 13:50:00 +0200

alt-nodejs14-nodejs (14.20.0-2) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 07 Feb 2022 15:00:00 +0100
