# changelog

author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-7
changelog:
  - CVE-2022-32212: fix IPv4 validation in inspector_socket to properly validate
    IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable
    dot-counting parser with proper octet validation, add tests


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-8
changelog:
  - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering
    with Hash class internals in policy mechanism


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-10
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits()
    that could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-11
changelog:
  - CVE-2022-32213: fix missing CR validation in header separators to prevent
    HTTP request smuggling via malformed headers
  - CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
    and repeated chunked encoding values
  - CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
    attacks via conflicting encoding declarations
  - CVE-2022-35256: fix header overflow calculation to properly detect and
    reject oversized HTTP headers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-13
changelog:
  - CVE-2023-46809: fix a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-14
changelog:
  - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource
    exhaustion during decompression


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-15
changelog:
  - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection
    on abrupt socket close


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 12.22.12-16
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism that could expose uninitialized memory when using vm module with
    timeout options, preventing potential information disclosure


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-17
changelog:
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-2.tuxcare.els6
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that
    could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-4
changelog:
  - CVE-2023-32559: disable process.binding() when policy is enabled,
    update deprecations and errors docs, add new tests ensuring denial behavior,
    include new policy + app test fixtures


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-5
changelog:
  - CVE-2023-30589: fix llhttp parser to properly validate LF after CR
    in HTTP header fields, add lenient flag checks before allowing CR without LF,
    add test file to verify the fix prevents request smuggling attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-11
changelog:
  - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data.


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-1.1.tuxcare.els3
changelog:
  - CVE-2024-28863: prevent extraction in excessively deep sub-folders to address unlimited
    sub-folders vulnerability


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-1.1.tuxcare.els4
changelog:
  - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when
    parsing configuration files with embedded NULL characters


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-1.1.tuxcare.els5
changelog:
  - CVE-2023-32002: prevent Module.constructor._load() bypass by adding constructor
    property protection
  - CVE-2023-32006: prevent require.main.constructor and require.extensions bypass
    by implementing secure module loading validation


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-21
changelog:
  - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame
    so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow
    instead of leaking memory


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-22
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants so consecutive numeric strings no longer collide in V8's
    internal string table (HashDoS via JSON.parse)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-23
changelog:
  - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing
    the policy-aware require() on the module prototype and assigning
    process.mainModule via setOwnProperty(), closing the
    process.mainModule.__proto__.require() experimental-policy bypass
  - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream
    nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled
    nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming
    RST_STREAM frames now trigger a GOAWAY instead of unbounded work


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-24
changelog:
  - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent
    silent authority rebinding via C-string truncation in the resolver bindings
    (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes)
  - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a
    malicious server can no longer cause unbounded memory growth via ORIGIN frames
    (backport of nodejs/node@c79968e1)
  - CVE-2026-48933: crypto: guard the cipher output-length computation against
    signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc
    (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1.1.1p-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free on empty digestAlgorithms)
  - Build on CL8 again: drop ExcludeArch: x86_64 (ELS-2378)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-8
changelog:
  - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to
    prevent sensitive data leakage


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-12
changelog:
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 16.20.2-13
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism preventing race condition that could expose uninitialized memory


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-16
changelog:
  - Obsolete alt-nodejs16-openssl{,-devel,-libs} < 1.1.1e on el8+ to prevent
    OPENSSL_1_1_1e symbol version mismatch when stale alt OpenSSL in RPATH
    shadows system OpenSSL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-17
changelog:
  - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data
    boundary, allowing attackers to tamper with backend requests under certain
    conditions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-18
changelog:
  - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to
    prevent uncaught TypeError when a __proto__ header is received and the
    application accesses req.headersDistinct or req.trailersDistinct


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-1.tuxcare.els3
changelog:
  - CVE-2025-23166: fix incorrect ThrowException() call in background thread
    to prevent process crash


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-19
changelog:
  - CVE-2026-21713: use CRYPTO_memcmp instead of memcmp in Web Cryptography
    HMAC signature verification to prevent timing attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-21
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants, so consecutive numeric strings no longer collide in V8's
    internal string table


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-22
changelog:
  - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM
    rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled
    deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY
    is sent, tearing down peers that rapidly open and cancel HTTP/2 streams.
    Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in
    1.57.0), no wholesale version bump


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-23
changelog:
  - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport
    upstream c79968e108 (first in v22.23.0): cap the client-side originSet
    (default 128, configurable via options.maxOriginSetSize on connect) and
    destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded.
    Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present.
  - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding.
    Backport upstream 7dafafa242 (first in v22.23.0): add
    validateStringWithoutNullBytes() and reject embedded NUL bytes in the
    hostname/options.host arguments of dns.lookup, dnsPromises.lookup and
    net.connect before they reach the NUL-terminated C resolver.
  - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow.
    Backport upstream 98fbc89211 (first in v22.23.0): add
    TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in
    AES_Cipher() so an input length near 2 GiB fails cleanly instead of
    overflowing the signed int buffer length and aborting the process.


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-5
changelog:
  - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch
    blocks to route exceptions through error handlers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-11
changelog:
  - CVE-2026-21712: return original href when ada::parse fails in
    url.format() instead of crashing on malformed IDN hostnames


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-14
changelog:
  - CVE-2026-48619: cap http2 client originSet size (default 128, option
    maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS,
    preventing unbounded memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via
    new validateStringWithoutNullBytes, preventing silent authority rebinding
    from c-string truncation in the resolver bindings
  - CVE-2026-48933: guard the WebCrypto AES cipher output length with
    TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of
    overflowing the signed int buffer length and aborting the process


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-15
changelog:
  - CVE-2026-48618: IDNA-normalize the hostname with domainToASCII() before
    label-splitting in tls.checkServerIdentity(), so Unicode dot separators
    (U+3002/U+FF0E/U+FF61) can no longer collapse labels and let a shallower
    wildcard certificate match; IP literals stay un-normalized so IPv6
    IP-Address SANs keep matching (includes follow-up 1d87a24050)
  - CVE-2026-48928: add the 'i' flag to the SNI matching RegExp built by
    tls.Server.prototype.addContext(), so uppercase or mixed-case SNI hostnames
    select their intended per-hostname SecureContext instead of falling back to
    the default context and bypassing mTLS client-certificate authorization
  - CVE-2026-48934: bind reusable client TLS sessions to the authenticated host
    by wrapping session state with the target servername and gating
    setSession()/tls.connect({ session }) through getSessionForReuse(),
    preventing a session from one host being resumed against another with
    checkServerIdentity() skipped


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-16
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool with a handle-level onread guard (installFreeSocketDataGuard /
    removeFreeSocketDataGuard), destroying sockets that receive unsolicited data
    while the HTTPParser is detached so a server can no longer poison the
    response queue of the next request; includes the upstream follow-up that
    avoids stream listeners on idle sockets
  - CVE-2026-48937: detect in OnFrameSent a GOAWAY that nghttp2 queued
    internally (no callback is invoked for frame-size, padding or HPACK
    errors) and raise NGHTTP2_ERR_PROTO at the end of SendPendingData so the
    Http2Session is destroyed after the GOAWAY is written, instead of the
    server accepting data forever on an abandoned session


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-17
changelog:
  - CVE-2025-23167: restore terminator validation in the loose state machine of the
    bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done,
    chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require
    the LF after a CR instead of consuming any byte; a header block ending in
    "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather
    than swallowing the byte and parsing what follows as a second, smuggled request


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 20.20.2-3
changelog:
  - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded
    memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to
    prevent silent authority rebinding via C-string truncation
  - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed
    integer overflow on ~2 GiB inputs


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-4
changelog:
  - CVE-2026-48618: tls: normalize the hostname with domainToASCII() before
    splitting it into labels in checkServerIdentity(), so Unicode dot
    separators cannot defeat the wildcard-depth check
  - CVE-2026-48928: tls: match SNI contexts case-insensitively in
    Server.prototype.addContext() as required by RFC 6066
  - CVE-2026-48934: tls: bind reusable client sessions to the host they were
    authenticated for, so a resumed session cannot skip host verification


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-5
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool against unsolicited data to prevent response queue poisoning
  - CVE-2026-48937: destroy the HTTP/2 session when nghttp2 internally sends a
    GOAWAY so the server stops accepting data after a protocol error


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-6
changelog:
  - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission
    so diagnostic reports cannot escape the --allow-fs-write allow-list
  - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is
    enabled so file timestamps cannot be changed with read-only access


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-1
changelog:
  - Pin $releasever to the EL major version in the repo file to avoid HTTP 404
    on point-release hosts where $releasever resolves to e.g. 7.9


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-2
changelog:
  - Ship alt-nodejs-els-rollout.repo with the els-alt-1..6 gradual-rollout slots
    (enabled) and their -bypass counterparts (disabled), so the ALT slot
    rollout reaches clients gradually instead of only at graduation to stable


