[CLSA-2026:1794442363] Fix of 12 CVEs

Type:

security

Severity:

Low

Release date:

2026-11-12 00:13:00 UTC

Description:

   * SECURITY UPDATE: guard against a null write request on a cancelled http2
     stream
     - debian/patches/CVE-2026-123875.patch: guard against a null write
       request on a cancelled http2 stream
     - CVE-2026-123875
   * SECURITY UPDATE: detect http2 streams abandoned by nghttp2
     - debian/patches/CVE-2026-123865.patch: detect http2 streams abandoned
       by nghttp2
     - CVE-2026-123865
   * SECURITY UPDATE: avoid overflowing ALTSVC buffers
     - debian/patches/CVE-2026-123828.patch: avoid overflowing ALTSVC buffers
     - CVE-2026-123828
   * SECURITY UPDATE: handle zlib params callback after destroy
     - debian/patches/CVE-2026-123862.patch: handle zlib params callback
       after destroy
     - CVE-2026-123862
   * SECURITY UPDATE: release http2 headers when a stream is removed
     - debian/patches/CVE-2026-123863.patch: release http2 headers when a
       stream is removed
     - CVE-2026-123863
   * SECURITY UPDATE: prevent nested parser execution from empty writes
     - debian/patches/CVE-2026-123864.patch: prevent nested parser execution
       from empty writes
     - CVE-2026-123864
   * SECURITY UPDATE: apply the CA of SNI contexts without a certificate
     - debian/patches/CVE-2026-123867.patch: apply the CA of SNI contexts
       without a certificate
     - CVE-2026-123867
   * SECURITY UPDATE: isolate https Agent TLS policy keys
     - debian/patches/CVE-2026-123877.patch: isolate https Agent TLS policy
       keys
     - CVE-2026-123877
   * SECURITY UPDATE: retain http2 buffers until socket writes finish
     - debian/patches/CVE-2026-123866.patch: retain http2 buffers until
       socket writes finish
     - CVE-2026-123866
   * SECURITY UPDATE: charge inbound DATA retained by streams to
     maxSessionMemory
     - debian/patches/CVE-2026-123868.patch: charge inbound DATA retained by
       streams to maxSessionMemory
     - CVE-2026-123868
   * SECURITY UPDATE: prevent TLS resumption, renegotiation and HRR from
     changing SNI
     - debian/patches/CVE-2026-123872.patch: prevent TLS resumption,
       renegotiation and HRR from changing SNI
     - CVE-2026-123872
   * SECURITY UPDATE: retain http2 streams during pending writes
     - debian/patches/CVE-2026-123874.patch: retain http2 streams during
       pending writes
     - CVE-2026-123874

CVEs fixed:

Updated packages:

alt-nodejs18-docs_18.20.8-27_amd64.deb
sha:ab4c6d836b80de80f4e8b9e659bacdd19f9f4c7a
alt-nodejs18-nodejs_18.20.8-27_amd64.deb
sha:ac177e0e3063b306b0577c6a2cd66bd054adb457
alt-nodejs18-nodejs-devel_18.20.8-27_amd64.deb
sha:05de8e1a283dc3ba66ca81c01b793aeb521a088a
alt-nodejs18-npm_10.8.2-18.20.8.27_amd64.deb
sha:f5e991bd841e1e03ed057826a90c039ee55945dc

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.