Release date:
2026-11-11 23:45:41 UTC
Description:
- CVE-2026-123865: detect streams abandoned by nghttp2
- CVE-2026-123828: avoid overflowing ALTSVC buffers
- CVE-2026-123862: handle zlib params callback after destroy
- CVE-2026-123863: release headers when a stream is removed
- CVE-2026-123864: prevent nested parser execution from empty writes
- CVE-2026-123867: apply the CA of SNI contexts without a certificate
- CVE-2026-123866: retain buffers until socket writes finish
- CVE-2026-123868: charge inbound DATA retained by streams to maxSessionMemory
- CVE-2026-123877: isolate Agent TLS policy keys
- CVE-2026-123872: do not allow resumption, renegotiation or HRR to change SNI
- CVE-2026-123874: retain streams during pending writes
Updated packages:
-
alt-nodejs16-nodejs-16.20.2-35.el7.x86_64.rpm
sha:8b519c66cdfe95c140b7813f6e715ec100164115b39b14ced2a010982a94e785
-
alt-nodejs16-nodejs-devel-16.20.2-35.el7.x86_64.rpm
sha:7c6ecbf431fd55bbbba2689951bd97ecd99fcf4d6cf306a5ba95f5de6f116e7c
-
alt-nodejs16-nodejs-docs-16.20.2-35.el7.noarch.rpm
sha:d9b0b7c72dc6a1bf2ab755913ece9902c68b89f7598bd2283dc813642d705b05
-
alt-nodejs16-npm-8.19.4-16.20.2.35.el7.x86_64.rpm
sha:54214ef0bb6daf2cd64eba98950259ffb82a9d933ba8efab75b8da5927b7d6ff
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
