alt-nodejs18-nodejs (18.20.8-17) stable; urgency=medium

  * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination
    in the bundled llhttp parser
    - debian/patches/CVE-2025-23167.patch: restore terminator validation in the
      loose (non-strict) state machine of the bundled llhttp 6.1.1, which Node
      compiles by default (LLHTTP_STRICT_MODE is never set): headers_almost_done,
      chunk_size_almost_done and the chunk_data_almost_done /
      chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after
      a CR instead of consuming any byte, and res_line_almost_done requires the LF
      after the response status line's CR, so a header block ending in "\r\n\rX"
      or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of
      silently swallowing the byte and parsing the bytes that follow as a second,
      smuggled request; each accept/reject edge was derived from the loose
      machine's own goto graph rather than by copying the strict machine's labels,
      which are not interchangeable between the two halves (no upstream Node.js 18
      fix exists — 18.x went EOL before disclosure, and upstream fixed this by
      replacing the parser wholesale with llhttp 9; approximated from llhttp
      6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2)
    - CVE-2025-23167

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-16) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in http.Agent
    - debian/patches/CVE-2026-48931.patch: guard idle keep-alive sockets parked
      in the http.Agent freeSockets pool by swapping the handle's onread
      callback for freeSocketOnReadGuard (installFreeSocketDataGuard) and
      restoring it in reuseSocket, so unsolicited data arriving while the
      HTTPParser is detached destroys the socket instead of being consumed as
      the response to the next request that reuses it; includes the upstream
      follow-up that keeps the guard off the public stream to avoid the
      ERR_STREAM_PREMATURE_CLOSE keep-alive regression (no upstream Node.js 18
      fix exists — 18.x went EOL before disclosure; adapted from 0a22d40180,
      first in v22.23.0, plus eaa292549e, first in v22.23.1)
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after GOAWAY on invalid
    protocol errors
    - debian/patches/CVE-2026-48937.patch: detect in Http2Session::OnFrameSent
      a GOAWAY that nghttp2 queued internally via
      nghttp2_session_terminate_session() (frame-size, padding or HPACK
      errors, for which nghttp2 invokes no callback), record it in a new
      internal_goaway_sent_ flag and raise NGHTTP2_ERR_PROTO at the end of
      SendPendingData() so JS tears the session down once the GOAWAY has been
      written; Http2Session::Goaway() sets goaway_initiated_ so an
      application-requested GOAWAY is never mistaken for an internal one,
      stopping the server from indefinitely accepting data on a session it has
      already abandoned (no upstream Node.js 18 fix exists — 18.x went EOL
      before disclosure; adapted from a1a5bb9683, first in v22.23.0, minus the
      IsGracefulCloseInitiated() guard that does not exist in 18.x)
    - CVE-2026-48937

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-15) stable; urgency=medium

  * SECURITY UPDATE: Unicode dot separators defeat the TLS wildcard-depth check
    - debian/patches/CVE-2026-48618.patch: IDNA-normalize the hostname with
      domainToASCII() before splitting it into labels in
      tls.checkServerIdentity(), so the verifier counts the same labels the
      resolver does and a *.example.com certificate no longer matches
      foo。bar.example.com (U+3002/U+FF0E/U+FF61 fold to '.'); IP literals are
      still matched un-normalized so IPv6 IP-Address SANs keep working (no
      upstream Node.js 18 fix exists — 18.x went EOL before disclosure;
      adapted from 2197a47144, first in v22.23.0, plus follow-up 1d87a24050)
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching allows mTLS
    client-certificate authorization bypass
    - debian/patches/CVE-2026-48928.patch: build the SNI matching RegExp in
      tls.Server.prototype.addContext() with the 'i' flag, so an uppercase or
      mixed-case SNI hostname from the ClientHello selects its intended
      per-hostname SecureContext instead of silently falling back to the
      server's default context and bypassing per-tenant client-certificate
      policy, as required by RFC 6066 Section 3 (no upstream Node.js 18 fix
      exists — 18.x went EOL before disclosure; adapted from 39d1d09684,
      first in v22.23.0)
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session reuse
    with a different servername
    - debian/patches/CVE-2026-48934.patch: bind client TLS sessions to the
      host they were authenticated for — wrap sessions handed to applications
      with a "\0nodejs:tls:session:1\0" + servername prefix in
      onnewsessionclient() and a new explicit TLSSocket.getSession(), and route
      setSession()/tls.connect({ session }) through getSessionForReuse(), which
      refuses a session recorded for a different servername and refuses raw
      unbound sessions on verified client connections, so a session obtained
      from one host can no longer be replayed against another with
      checkServerIdentity() skipped (no upstream Node.js 18 fix exists — 18.x
      went EOL before disclosure; adapted from fd890ba01d plus the regression
      tests from 1662a3ea09, first in v22.23.0)
    - CVE-2026-48934

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-14) stable; urgency=medium

  * SECURITY UPDATE: http2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the http2 client originSet
      size (default 128, configurable via the connect() maxOriginSetSize
      option) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once
      exceeded, so a malicious server can no longer grow originSet without
      bound (no upstream Node.js 18 fix exists — 18.x went EOL before
      disclosure; adapted from c79968e108, first in v22.23.0)
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      and reject hostnames/hosts containing an embedded NUL byte in
      dns.lookup(), dnsPromises.lookup() and net.connect()/createConnection(),
      preventing c-string truncation in the resolver bindings from resolving a
      different authority than the one validated (adapted from 7dafafa2, first
      in v22.23.0)
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto cipher output-length signed integer overflow
    - debian/patches/CVE-2026-48933.patch: guard the WebCrypto AES output
      length with TryGetIntCipherOutputLength so inputs near 2 GiB fail cleanly
      instead of overflowing the signed int buffer length and aborting the
      process (adapted from 98fbc89211, first in v22.23.0)
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-13) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 10.2.154.26
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream Node.js 18 fix exists — 18.x
      went EOL before disclosure; this is an adapted reduced port, no
      rapidhash / HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 26 May 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-12) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 14:00:00 +0200

alt-nodejs18-nodejs (18.20.8-11) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 12:00:00 +0200

alt-nodejs18-nodejs (18.20.8-10) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 08:16:37 +0000

alt-nodejs18-nodejs (18.20.8-9) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs18-nodejs (18.20.8-8) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs18-nodejs (18.20.8-5) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that allowed JavaScript to control
      ArrayBuffer initialization via shared memory, preventing race condition
      that could expose uninitialized memory when using vm module with timeouts
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-4) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback
      invocations in try-catch blocks to route exceptions through error
      handlers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 05 Feb 2026 15:00:00 +0000

alt-nodejs18-nodejs (18.20.8-3) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs18-nodejs (18.20.8-2) stable; urgency=medium

  * Added support for CVE-2025-23166 for Debian 13

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 08 Dec 2025 16:30:00 +0000

alt-nodejs18-nodejs (18.20.8-1+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException() call
    in background thread to prevent process crash
    - CVE-2025-23166

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 12 Sep 2025 15:10:57 +0100

alt-nodejs18-nodejs (18.20.8-1) stable; urgency=medium

  * ALTNJS-207: update to 18.20.8

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 03 Jun 2025 14:09:00 +0100 

alt-nodejs18-nodejs (18.20.7-1) stable; urgency=medium

  * ALTNJS-205: update to 18.20.7

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100 

alt-nodejs18-nodejs (18.20.6-1) stable; urgency=medium

  * ALTNJS-202: update to 18.20.6

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100

alt-nodejs18-nodejs (18.20.5-1) stable; urgency=medium

  * ALTNJS-199: update to 18.20.5

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 09 Jan 2025 22:00:00 +0100
 
alt-nodejs18-nodejs (18.20.4-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.4-1) stable; urgency=medium

  * ALTNJS-191: Update to 18.20.4.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 15 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.3-1) stable; urgency=medium

  * ALTNJS-187: update to 18.20.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 10 Jun 2024 22:00:00 +0200

alt-nodejs18-nodejs (18.20.2-1) stable; urgency=medium

  * ALTNJS-178: update to 18.20.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 13:48:00 +0200

alt-nodejs18-nodejs (18.20.0-1) stable; urgency=medium

  * ALTNJS-174: Update to 18.20.0 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 29 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.19.1-1) stable; urgency=medium

  * ALTNJS-166: Update to 18.19.1 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 26 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.18.2-1) stable; urgency=medium

  * ALTNJS-158: Update to 18.18.2 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 31 Oct 2023 14:20:00 +0200

alt-nodejs18-nodejs (18.17.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
