Release date:
2026-11-11 23:47:40 UTC
Description:
- CVE-2026-123865: detect streams abandoned by nghttp2
- CVE-2026-123828: avoid overflowing ALTSVC buffers
- CVE-2026-123862: handle zlib params callback after destroy
- CVE-2026-123863: release headers when a stream is removed
- CVE-2026-123864: prevent nested parser execution from empty writes
- CVE-2026-123867: apply the CA of SNI contexts without a certificate
- CVE-2026-123866: retain buffers until socket writes finish
- CVE-2026-123868: charge inbound DATA retained by streams to maxSessionMemory
- CVE-2026-123877: isolate Agent TLS policy keys
- CVE-2026-123872: do not allow resumption, renegotiation or HRR to change SNI
- CVE-2026-123874: retain streams during pending writes
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-35.el9.x86_64.rpm
sha:ccb7eadfe97f0f75e1969272437065ae9d6113329ec1d8587b3592586d81cf02
-
alt-nodejs16-nodejs-devel-16.20.2-35.el9.x86_64.rpm
sha:803f9762016292c50868d5afdd5d40ebfc1eeeec99f28ffcd980241bda9ba411
-
alt-nodejs16-nodejs-docs-16.20.2-35.el9.noarch.rpm
sha:8005a22fe477b2b699c9cbabc2773c5d097b0050eadaeef9ebfda7c71c3c9d7e
-
alt-nodejs16-npm-8.19.4-16.20.2.35.el9.x86_64.rpm
sha:2409cb4edcfddca40251052cc58fc03e33c62895357315463086f85f1481c2da
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
