alt-nodejs16-nodejs (16.20.2-20) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 9.4.146.26
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream Node.js 16 fix exists — 16.x
      went EOL before disclosure; this is an adapted reduced port, no
      rapidhash / HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 26 May 2026 13:00:00 +0000

alt-nodejs16-nodejs (16.20.2-19) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 14:30:00 +0200

alt-nodejs16-nodejs (16.20.2-18) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 08:16:37 +0000

alt-nodejs16-nodejs (16.20.2-17) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs16-nodejs (16.20.2-16) stable; urgency=medium

  * SECURITY UPDATE: undici predictable multipart/form-data boundary
    - debian/patches/CVE-2025-22150.patch: replace Math.random() with
      crypto.randomInt() for the boundary string in bundled undici
      (deps/undici/src/lib/fetch/body.js). Math.random() output is
      predictable from a few sampled values, allowing attackers who can
      observe multipart requests to attacker-controlled servers to tamper
      with subsequent requests to backend APIs.
    - CVE-2025-22150

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 09:31:15 +0200

alt-nodejs16-nodejs (16.20.2-15) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs16-nodejs (16.20.2-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that allowed JavaScript to control
      ArrayBuffer initialization via shared memory, preventing race condition
      that could expose uninitialized memory when using vm module with timeouts
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 22:40:00 +0000

alt-nodejs16-nodejs (16.20.2-11) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 06 Feb 2026 14:00:00 +0100

alt-nodejs16-nodejs (16.20.2-10) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs16-nodejs (16.20.2-9) stable; urgency=low

  * SECURITY UPDATE: Node.js undici cross-origin redirect vulnerability
    - debian/patches/CVE-2023-45143.patch: clear Cookie and Host headers on
      cross-origin redirects to prevent sensitive data leakage
    - CVE-2023-45143

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 17 Dec 2025 12:00:00 +0000

alt-nodejs16-nodejs (16.20.2-8) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 12 Dec 2025 10:00:00 +0000

alt-nodejs16-nodejs (16.20.2-7) stable; urgency=medium

  * SECURITY UPDATE: Node.js code injection names export
    - debian/patches/CVE-2023-39333.patch: implement the mechanism in
      createExport() that avoids JavaScript code injection
    - CVE-2023-39333

 -- Eugeniusz Jarocki <ejarocki@cloudlinux.com>  Mon, 08 Dec 2025 17:37:51 +0000

alt-nodejs16-nodejs (16.20.2-6) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 03 Dec 2025 14:00:00 +0000

alt-nodejs16-nodejs (16.20.2-5) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 02 Dec 2025 18:43:54 +0000

alt-nodejs16-nodejs (16.20.2-4) stable; urgency=medium

  * Fix build for Ubuntu24.04

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Tue, 02 Dec 2025 13:01:00 +0400

alt-nodejs16-nodejs (16.20.2-3) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      to prevent forged checksums and tampering with Hash class internals
      in the policy mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 05 Nov 2025 10:19:25 -0500

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els3) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 14 Oct 2025 13:23:49 -0400

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js c-ares out-of-bounds read vulnerability
    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to
      prevent out-of-bounds read when parsing configuration files with
      embedded NULL characters
    - CVE-2024-25629

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 08 Oct 2025 11:31:38 +0000

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js node-tar denial of service via excessive folder nesting
    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 03 Oct 2025 09:58:29 +0000

alt-nodejs16-nodejs (16.20.2-2+tuxcare.els) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els3) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException()
    call in background thread to prevent process crash
    - CVE-2025-23166

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 23 Sep 2025 12:57:38 -0400

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els2) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP/2 server memory leak on connection termination
    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Fri, 19 Sep 2025 11:17:03 +0000

alt-nodejs16-nodejs (16.20.2-1+tuxcare.els1) stable; urgency=high

  * SECURITY UPDATE: Node.js HTTP/2 server denial of service vulnerability
    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams
      during session destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 08 Sep 2025 13:35:57 +0000

alt-nodejs16-nodejs (16.20.2-1) stable; urgency=medium

  * ALTNJS-125: Update to 16.20.2 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 01 Nov 2023 14:20:00 +0200

alt-nodejs16-nodejs (16.20.1-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
