alt-nodejs18-nodejs (18.20.8-13) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 10.2.154.26
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream Node.js 18 fix exists — 18.x
      went EOL before disclosure; this is an adapted reduced port, no
      rapidhash / HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 26 May 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-12) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 14:00:00 +0200

alt-nodejs18-nodejs (18.20.8-11) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 12:00:00 +0200

alt-nodejs18-nodejs (18.20.8-10) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 08:16:37 +0000

alt-nodejs18-nodejs (18.20.8-9) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs18-nodejs (18.20.8-8) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs18-nodejs (18.20.8-5) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that allowed JavaScript to control
      ArrayBuffer initialization via shared memory, preventing race condition
      that could expose uninitialized memory when using vm module with timeouts
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-4) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback
      invocations in try-catch blocks to route exceptions through error
      handlers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 05 Feb 2026 15:00:00 +0000

alt-nodejs18-nodejs (18.20.8-3) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs18-nodejs (18.20.8-2) stable; urgency=medium

  * Added support for CVE-2025-23166 for Debian 13

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 08 Dec 2025 16:30:00 +0000

alt-nodejs18-nodejs (18.20.8-1+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException() call
    in background thread to prevent process crash
    - CVE-2025-23166

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 12 Sep 2025 15:10:57 +0100

alt-nodejs18-nodejs (18.20.8-1) stable; urgency=medium

  * ALTNJS-207: update to 18.20.8

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 03 Jun 2025 14:09:00 +0100 

alt-nodejs18-nodejs (18.20.7-1) stable; urgency=medium

  * ALTNJS-205: update to 18.20.7

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100 

alt-nodejs18-nodejs (18.20.6-1) stable; urgency=medium

  * ALTNJS-202: update to 18.20.6

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100

alt-nodejs18-nodejs (18.20.5-1) stable; urgency=medium

  * ALTNJS-199: update to 18.20.5

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 09 Jan 2025 22:00:00 +0100
 
alt-nodejs18-nodejs (18.20.4-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.4-1) stable; urgency=medium

  * ALTNJS-191: Update to 18.20.4.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 15 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.3-1) stable; urgency=medium

  * ALTNJS-187: update to 18.20.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 10 Jun 2024 22:00:00 +0200

alt-nodejs18-nodejs (18.20.2-1) stable; urgency=medium

  * ALTNJS-178: update to 18.20.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 13:48:00 +0200

alt-nodejs18-nodejs (18.20.0-1) stable; urgency=medium

  * ALTNJS-174: Update to 18.20.0 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 29 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.19.1-1) stable; urgency=medium

  * ALTNJS-166: Update to 18.19.1 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 26 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.18.2-1) stable; urgency=medium

  * ALTNJS-158: Update to 18.18.2 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 31 Oct 2023 14:20:00 +0200

alt-nodejs18-nodejs (18.17.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
