Release date:
2026-11-11 23:46:56 UTC
Description:
- CVE-2026-123865: detect streams abandoned by nghttp2
- CVE-2026-123828: avoid overflowing ALTSVC buffers
- CVE-2026-123862: handle zlib params callback after destroy
- CVE-2026-123863: release headers when a stream is removed
- CVE-2026-123864: prevent nested parser execution from empty writes
- CVE-2026-123867: apply the CA of SNI contexts without a certificate
- CVE-2026-123866: retain buffers until socket writes finish
- CVE-2026-123868: charge inbound DATA retained by streams to maxSessionMemory
- CVE-2026-123877: isolate Agent TLS policy keys
- CVE-2026-123872: do not allow resumption, renegotiation or HRR to change SNI
- CVE-2026-123874: retain streams during pending writes
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-35.el10.x86_64.rpm
sha:697c35678c256c2227002732eb9f1a4dd9d78b796cc492c30ca60cc026ce1aaf
-
alt-nodejs16-nodejs-devel-16.20.2-35.el10.x86_64.rpm
sha:761d9cbb85769d672aa944f410537aa487fadff8c5120fab77560263771d19cc
-
alt-nodejs16-nodejs-docs-16.20.2-35.el10.noarch.rpm
sha:8b922e06a5f0bbceb60793d40edbe20814dbcf2da4b91935ad06b50f6cb9fb23
-
alt-nodejs16-npm-8.19.4-16.20.2.35.el10.x86_64.rpm
sha:1b3ca71c3d5ecf0d4b42f6d4f07a25ed8efc84c24bb6a52f2b9eea9017f511b9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
