[CLSA-2026:1781263596] Fix CVE(s): CVE-2023-30581, CVE-2023-44487

Type:

security

Severity:

Important

Release date:

2026-06-12 11:29:29 UTC

Description:

   * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__
     - debian/patches/CVE-2023-30581.patch: install the policy-aware require()
       on the module prototype and assign process.mainModule via
       setOwnProperty(), so process.mainModule.__proto__.require() can no
       longer escape the --experimental-policy manifest restrictions
     - CVE-2023-30581
   * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service
     - debian/patches/CVE-2023-44487.patch: backport the upstream nghttp2
       1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2
       1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM
       frames now tear the connection down with GOAWAY instead of doing
       unbounded per-stream work
     - CVE-2023-44487

CVEs fixed:

Updated packages:

alt-nodejs14-docs_14.21.3-24_amd64.deb
sha:5a9c5f5c08b09ff48134b69ad8099779f2cf0284
alt-nodejs14-nodejs_14.21.3-24_amd64.deb
sha:a736046bfd06f9b86e00262e6a5b98da8a43db83
alt-nodejs14-nodejs-devel_14.21.3-24_amd64.deb
sha:cf3997880d61fa1a23e7905887a356acfe5db1b0
alt-nodejs14-npm_6.14.18-14.21.3-24_amd64.deb
sha:a3b889f592b6f69165fcf441995d1abed26baf54

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.