ea-nodejs22 (22.23.0-2+4.1.cpanel) stable; urgency=low

  * EA-13467: Add CVE documentation for Node.js 22.23.0
  * CVE-2026-48618: TLS hostname not normalized for server identity checks - wildcard certificate auth bypass (High)
  * CVE-2026-48933: WebCrypto cipher output length not guarded - AES integer overflow crash (High)
  * CVE-2026-48937: HTTP/2 sessions not cleaned up after GOAWAY on invalid protocol errors (Medium)
  * CVE-2026-48930: dns/net hostnames with embedded NUL bytes accepted - silent authority rebinding (Medium)
  * CVE-2026-48619: HTTP/2 originSet size uncapped - unbounded memory growth via ORIGIN frames (Medium)
  * CVE-2026-48615: HTTP proxy credentials leaked in ERR_PROXY_TUNNEL error messages (Medium)
  * CVE-2026-48934: TLS reusable sessions not bound to authenticated host - identity verification bypass (Medium)
  * CVE-2026-48928: TLS case-sensitive SNI context matching bypass in mTLS (Medium)
  * CVE-2026-48617: Permission model process.report.writeReport() path misvalidation bypass (Low)
  * CVE-2026-48931: HTTP response queue poisoning in http.Agent via TOCTOU race (Low)
  * CVE-2026-48935: Permission model FileHandle.utimes() read-only file restriction bypass (Low)

 -- Cory McIntire <cory.mcintire@webpros.com>  Thu, 18 Jun 2026 00:00:00 -0000

ea-nodejs22 (22.23.0-1) stable; urgency=low

  * EA-13467: Update ea-nodejs22 from v22.22.3 to v22.23.0

 -- EA4 Update Bot <cory.mcintire@webpros.com>  Thu, 18 Jun 2026 00:00:00 -0000

ea-nodejs22 (22.22.3-1) stable; urgency=low

  * EA-13437: Update ea-nodejs22 from v22.22.2 to v22.22.3

 -- EA4 Update Bot <cory.mcintire@webpros.com>  Thu, 14 May 2026 00:00:00 -0000

ea-nodejs22 (22.22.2-2) stable; urgency=low

  * EA-13384: Add CVE documentation for Node.js 22.22.2
  * CVE-2026-21637: Improper network access restriction (High)
  * CVE-2026-21710: Permission model bypass via fs.lstat (High)
  * CVE-2026-21713: HTTP/2 CONTINUATION frame flood (Medium)
  * CVE-2026-21714: Prototype pollution via vm.runInNewContext (Medium)
  * CVE-2026-21717: Path traversal in module resolution (Medium)
  * CVE-2026-21715: Timing side-channel in crypto.timingSafeEqual (Low)
  * CVE-2026-21716: Unsafe default TLS cipher in legacy mode (Low)

 -- Cory McIntire <cory.mcintire@webpros.com>  Wed, 01 Apr 2026 00:00:00 -0000

ea-nodejs22 (22.22.2-1) stable; urgency=low

  * EA-13384: Update ea-nodejs22 from v22.22.1 to v22.22.2

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 24 Mar 2026 00:00:00 -0000

ea-nodejs22 (22.22.1-1) stable; urgency=low

  * EA-13363: Update ea-nodejs22 from v22.22.0 to v22.22.1

 -- Cory McIntire <cory.mcintire@webpros.com>  Thu, 05 Mar 2026 00:00:00 -0000

ea-nodejs22 (22.22.0-1) stable; urgency=low

  * EA-13315: Update ea-nodejs22 from v22.21.1 to v22.22.0
  * CVE-2025-55132 - HTTP Request Smuggling vulnerability in permission model
  * CVE-2025-59465 - TLSSocket default error handler vulnerability

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 13 Jan 2026 00:00:00 -0000

ea-nodejs22 (22.21.1-1) stable; urgency=low

  * EA-13245: Update ea-nodejs22 from v22.21.0 to v22.21.1

 -- Cory McIntire <cory.mcintire@webpros.com>  Wed, 29 Oct 2025 00:00:00 -0000

ea-nodejs22 (22.21.0-1) stable; urgency=low

  * EA-13222: Update ea-nodejs22 from v22.20.0 to v22.21.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 21 Oct 2025 00:00:00 -0000

ea-nodejs22 (22.20.0-1) stable; urgency=low

  * EA-13169: Update ea-nodejs22 from v22.19.0 to v22.20.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 07 Oct 2025 00:00:00 -0000

ea-nodejs22 (22.19.0-1) stable; urgency=low

  * EA-13081: Update ea-nodejs22 from v22.18.0 to v22.19.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Thu, 28 Aug 2025 00:00:00 -0000

ea-nodejs22 (22.18.0-1) stable; urgency=low

  * EA-13050: Update ea-nodejs22 from v22.17.1 to v22.18.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Fri, 01 Aug 2025 00:00:00 -0000

ea-nodejs22 (22.17.1-1) stable; urgency=low

  * EA-13027: Update ea-nodejs22 from v22.17.0 to v22.17.1

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 15 Jul 2025 00:00:00 -0000

ea-nodejs22 (22.17.0-1) stable; urgency=low

  * EA-12944: Update ea-nodejs22 from v22.16.0 to v22.17.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Thu, 26 Jun 2025 00:00:00 -0000

ea-nodejs22 (22.16.0-1) stable; urgency=low

  * EA-12884: Update ea-nodejs22 from v22.15.1 to v22.16.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Wed, 21 May 2025 00:00:00 -0000

ea-nodejs22 (22.15.1-1) stable; urgency=low

  * EA-12867: Update ea-nodejs22 from v22.15.0 to v22.15.1
  * Improper error handling in async cryptographic operations crashes process (CVE-2025-23166) - (high)
  * Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) - (low)

 -- Cory McIntire <cory.mcintire@webpros.com>  Wed, 14 May 2025 00:00:00 -0000

ea-nodejs22 (22.15.0-1) stable; urgency=low

  * EA-12832: Update ea-nodejs22 from v22.14.0 to v22.15.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Thu, 24 Apr 2025 00:00:00 -0000

ea-nodejs22 (22.14.0-1) stable; urgency=low

  * EA-12694: Update ea-nodejs22 from v22.13.1 to v22.14.0

 -- Cory McIntire <cory.mcintire@webpros.com>  Tue, 11 Feb 2025 00:00:00 -0000

ea-nodejs22 (22.13.1-1) stable; urgency=low

  * EA-12664: Update ea-nodejs22 from v22.13.0 to v22.13.1
  * Worker permission bypass via InternalWorker leak in diagnostics (CVE-2025-23083) - (high)
  * GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  * Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)

 -- Cory McIntire <cory@cpanel.net>  Tue, 21 Jan 2025 00:00:00 -0000

ea-nodejs22 (22.13.0-1) stable; urgency=low

  * EA-12635: Update ea-nodejs22 from v22.12.0 to v22.13.0

 -- Cory McIntire <cory@cpanel.net>  Tue, 07 Jan 2025 00:00:00 -0000

ea-nodejs22 (22.12.0-1) stable; urgency=low

  * EA-12599: Update ea-nodejs22 from v22.11.0 to v22.12.0

 -- Cory McIntire <cory@cpanel.net>  Tue, 03 Dec 2024 00:00:00 -0000

ea-nodejs22 (22.11.0-1) stable; urgency=low

  * EA-12513: Update ea-nodejs22 from v22.10.0 to v22.11.0

 -- Cory McIntire <cory@cpanel.net>  Mon, 04 Nov 2024 00:00:00 -0000

ea-nodejs22 (22.10.0-1) stable; urgency=low

  * EA-12472: Update ea-nodejs22 from v22.9.0 to v22.10.0

 -- Cory McIntire <cory@cpanel.net>  Wed, 16 Oct 2024 00:00:00 -0000

ea-nodejs22 (22.9.0-1) stable; urgency=low

  * EA-12393: Update ea-nodejs22 from v22.8.0 to v22.9.0

 -- Cory McIntire <cory@cpanel.net>  Tue, 17 Sep 2024 00:00:00 -0000

ea-nodejs22 (22.8.0-1) stable; urgency=low

  * EA-12366: Update ea-nodejs22 from v22.7.0 to v22.8.0

 -- Cory McIntire <cory@cpanel.net>  Tue, 03 Sep 2024 00:00:00 -0000

ea-nodejs22 (22.7.0-1) stable; urgency=low

  * EA-12349: Update ea-nodejs22 from v22.6.0 to v22.7.0

 -- Cory McIntire <cory@cpanel.net>  Thu, 22 Aug 2024 00:00:00 -0000

ea-nodejs22 (22.6.0-1) stable; urgency=low

  * EA-12324: Update ea-nodejs22 from v22.5.0 to v22.6.0

 -- Cory McIntire <cory@cpanel.net>  Tue, 06 Aug 2024 00:00:00 -0000

ea-nodejs22 (22.5.0-1) stable; urgency=low

  * EA-12289: Update ea-nodejs22 from v22.4.1 to v22.5.0

 -- Cory McIntire <cory@cpanel.net>  Thu, 18 Jul 2024 00:00:00 -0000

ea-nodejs22 (22.4.1-1) stable; urgency=low

  * EA-12265: Update ea-nodejs22 from v22.3.0 to v22.4.1
  * CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
  * CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
  * CVE-2024-22018 - fs.lstat bypasses permission model (Low)
  * CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
  * CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

 -- Cory McIntire <cory@cpanel.net>  Tue, 09 Jul 2024 00:00:00 -0000

ea-nodejs22 (22.3.0-1) stable; urgency=low

  * EA-12241: Update ea-nodejs22 from v22.2.0 to v22.3.0

 -- Cory McIntire <cory@cpanel.net>  Mon, 01 Jul 2024 00:00:00 -0000

ea-nodejs22 (22.2.0-1) stable; urgency=low

  * EA-12158: Update ea-nodejs22 from v22.1.0 to v22.2.0

 -- Cory McIntire <cory@cpanel.net>  Wed, 15 May 2024 00:00:00 -0000

ea-nodejs22 (22.1.0-1) stable; urgency=low

  * ZC-11803: Initial build

 -- Brian Mendoza <brian.mendoza@cpanel.net>  Mon, 06 May 2024 00:00:00 -0000

