[CLSA-2026:1788389923] alt-nodejs12-nodejs: Fix of 26 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-02 22:59:14 UTC
Description:
- Extend the ALTNJS-278 bundled-zlib build to el6. The guard added in 12.22.12-27 only excluded el7, so CL6 kept getting --shared-zlib and linked the base OS zlib 1.2.3, which is older than the 1.2.7 that made npm fail on CL7. npm install against registry.npmjs.org fails there with "Z_STREAM_ERROR: Invalid response body ...: Zlib error". Building against node's bundled deps/zlib (>= 1.2.11) fixes it, as it did on el7. No other platform changes: el8+ still links the system zlib. - Build el6 against alt-python27. el6's base python is 2.6.6 and Node.js 12 requires 2.7, so ./configure aborted with "Please use Python 2.7". el6 now BuildRequires alt-python27 (2.7.18, from the alt-python flavour repo) and puts it on PATH, as alt-nodejs14 already does. This also fixes the shebang rewrites in %prep, which emitted a literal "%{__python2}" on el6 because el6's rpm does not define that macro. - Fix the i686 build of the now-bundled deps/zlib. zlib.gyp compiles the SSE2 paths without adding -msse2, which only works where SSE2 is in the baseline ABI; on i686 gcc rejects the always_inline intrinsics with "target specific option mismatch". Backport the one-line-per-file sse2 target pragma that node 14's bundled zlib already carries (chunkcopy.h, fill_window_sse.c); a no-op on x86_64.
Updated packages:
  • alt-nodejs12-nodejs-12.22.12-29.el6.x86_64.rpm
    sha:b43d96a2e0d19bf5b6aece970a114a9c4eede26910cfc0b034fd45faf9c9bc72
  • alt-nodejs12-nodejs-devel-12.22.12-29.el6.x86_64.rpm
    sha:b9dbfdf31456e39d0852c6bdf6f6e148f9ecf35c979280d64520ae4c4b53bc31
  • alt-nodejs12-nodejs-docs-12.22.12-29.el6.noarch.rpm
    sha:16307c2a34a02a6e35a478be234d89c1dd82893749f5c4224f674b6139fa0071
  • alt-nodejs12-npm-6.14.16-12.22.12.29.el6.x86_64.rpm
    sha:e60d4d0e72af514f8c60622fc1a45f916eee220a65287f74ca910343bf8eb08e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.