ELSA-2026-47057

ELSA-2026-47057 - nodejs:24 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-31

Description

nodejs
[1:24.18.0-3]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar

[1:24.18.0-2]
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion

[1:24.18.0-1]
- Update to version 24.18.0

[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1

[1:24.14.1-1]
- Update to version 24.14.1

[1:24.13.0-1]
- Update to version 24.13.0

[1:24.11.1-2]
- Disable test-tls-session-cache.js as its not currently compatiable with
RHEL environment

[1:24.11.1-1]
- Update to version 24.11.1

[1:24.4.1-7]
- Add patch to prevent fips usage segfault

[1:24.4.1-6]
- Rename nodejs-npm back to npm

nodejs-nodemon
[3.1.14-2]
- Correction to sources for 3.1.14.

[3.1.14-1]
- Update to version 3.1.14

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121569

[2021.06-5]
- nodejs.req to properly detect bundled deps

Related CVEs

CVE-2026-13149

CVE-2026-59873

CVE-2026-59874

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nodejs-24.18.0-3.module+el9.8.0+90974+83075495.src.rpm	0214caeebee0a854a567820f0dae8b2bb4033da5d9ae31b558cfd24114cd7fd8	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+90974+83075495.src.rpm	06bb72178fad5aabb7431094dc0bc32575a2c618d10f3835daf30780e4688328	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.src.rpm	3e609d717f6038e78b086b242cb7a67b2f08e537d00372eed01295497a369686	-	ol9_aarch64_appstream
	nodejs-24.18.0-3.module+el9.8.0+90974+83075495.aarch64.rpm	1a910ac4b63de9c405b348806b6849ca855fb6632313cbdb49b35b9fbb25a4ed	-	ol9_aarch64_appstream
	nodejs-devel-24.18.0-3.module+el9.8.0+90974+83075495.aarch64.rpm	50a43ac0c9d309c01ae39c9f8caf1c0b141fca228153a2506084ed30d59cf5b8	-	ol9_aarch64_appstream
	nodejs-docs-24.18.0-3.module+el9.8.0+90974+83075495.noarch.rpm	b8870c5a1de61aecc25c30c3652e5b2f919e3692ef798ae5be18f785342d3f9d	-	ol9_aarch64_appstream
	nodejs-full-i18n-24.18.0-3.module+el9.8.0+90974+83075495.aarch64.rpm	7bd1037184c50e4f6122ca30ade69f28e9bf53e15d2eaa310a4dc6006f5c3357	-	ol9_aarch64_appstream
	nodejs-libs-24.18.0-3.module+el9.8.0+90974+83075495.aarch64.rpm	390fc21afdee6af9b56ade72a67be7563e1b8e576ea9fffaad86d703fbd278ae	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+90974+83075495.noarch.rpm	08c8e272cb2658650761636d475b7cc1777ef90143ccb92f6e08af1352b2c716	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	485f612fb14ad0dcc61fe2dbbe427fa78b59cb9350946740bc1cbe504b657546	-	ol9_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	498c5fb6cf7e4834b23849a0ef21f8286407866600f75fd3a69330f548fcbf28	-	ol9_aarch64_appstream
	npm-11.16.0-1.24.18.0.3.module+el9.8.0+90974+83075495.noarch.rpm	a4b8b4a036c9aa8ec48eec03208f1f339f113fa7cfae6e88ccc353e9fb6cf4bd	-	ol9_aarch64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.3.module+el9.8.0+90974+83075495.aarch64.rpm	36b2ba4c01cc93e45af65479d52e479c2b0d6b385e9564c73593d6ab09bdd507	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nodejs-24.18.0-3.module+el9.8.0+90974+83075495.src.rpm	0214caeebee0a854a567820f0dae8b2bb4033da5d9ae31b558cfd24114cd7fd8	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+90974+83075495.src.rpm	06bb72178fad5aabb7431094dc0bc32575a2c618d10f3835daf30780e4688328	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.src.rpm	3e609d717f6038e78b086b242cb7a67b2f08e537d00372eed01295497a369686	-	ol9_x86_64_appstream
	nodejs-24.18.0-3.module+el9.8.0+90974+83075495.x86_64.rpm	3364da7ae4b13a6a2521743c9ed668ad4fc7023fc84f56be26c74cd33eb28f0f	-	ol9_x86_64_appstream
	nodejs-devel-24.18.0-3.module+el9.8.0+90974+83075495.x86_64.rpm	793d261378383fdb0d37a8b710dcc66ed65db9e4b7c60b24ab89c5d73c33e6de	-	ol9_x86_64_appstream
	nodejs-docs-24.18.0-3.module+el9.8.0+90974+83075495.noarch.rpm	b8870c5a1de61aecc25c30c3652e5b2f919e3692ef798ae5be18f785342d3f9d	-	ol9_x86_64_appstream
	nodejs-full-i18n-24.18.0-3.module+el9.8.0+90974+83075495.x86_64.rpm	c0a7d6d504a4b58154c7c31230b17bc7a4892da4993c7a7f5032037e03d28409	-	ol9_x86_64_appstream
	nodejs-libs-24.18.0-3.module+el9.8.0+90974+83075495.x86_64.rpm	d6613b921127fefd549b2528fc81a68593aa891b242605f33cdedfbc64d45ab6	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+90974+83075495.noarch.rpm	08c8e272cb2658650761636d475b7cc1777ef90143ccb92f6e08af1352b2c716	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	485f612fb14ad0dcc61fe2dbbe427fa78b59cb9350946740bc1cbe504b657546	-	ol9_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	498c5fb6cf7e4834b23849a0ef21f8286407866600f75fd3a69330f548fcbf28	-	ol9_x86_64_appstream
	npm-11.16.0-1.24.18.0.3.module+el9.8.0+90974+83075495.noarch.rpm	a4b8b4a036c9aa8ec48eec03208f1f339f113fa7cfae6e88ccc353e9fb6cf4bd	-	ol9_x86_64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.3.module+el9.8.0+90974+83075495.x86_64.rpm	280af28508004bca2ccb8077b0478e8d18fb358626242ca0fa975b2a6a3f2175	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team