ELSA-2026-48033

ELSA-2026-48033 - nodejs22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-29

Description

[1:22.23.1-4]
- Fix CVE-2026-13149 (npm/brace-expansion)

[1:22.23.1-3]
- Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar)

[1:22.23.1-2]
- CVE-2026-42338 ip-address HTML escaping fix.

[1:22.23.1-1]
- Update to version 22.23.1

[1:22.22.2-2]
- De-bundle c-ares, libuv
- we waited for c-ares for about 4 months, so added conditional flag in
case it falls behind in future again, same for libuv

Related CVEs

CVE-2026-13149

CVE-2026-59873

CVE-2026-59874

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nodejs22-22.23.1-4.el10_2.src.rpm	5bc1f0242046dadedc307f899a81fc6282111de17dbb9763df519280cc2c7d77	-	ol10_aarch64_appstream
	nodejs-22.23.1-4.el10_2.aarch64.rpm	3d4e7f887dcb9ea47b5eeb012e87388346940c433e0448ba8da5166b6e191092	-	ol10_aarch64_appstream
	nodejs-devel-22.23.1-4.el10_2.aarch64.rpm	7dd555942c81e703359db11e71baf92aa0e1fa9e1a27c0050dbaf8fe4966dcc4	-	ol10_aarch64_appstream
	nodejs-docs-22.23.1-4.el10_2.noarch.rpm	033bbc907b2e39f54c4d8dd353b4d039446ec79d4d6f21a0c06a8a9ca62d0fc0	-	ol10_aarch64_appstream
	nodejs-full-i18n-22.23.1-4.el10_2.aarch64.rpm	d388d55b0305d55d7ed1995d7918d0c3059bef9dc285ab699fce550c127c181c	-	ol10_aarch64_appstream
	nodejs-libs-22.23.1-4.el10_2.aarch64.rpm	0f6a4304571b3ebde1fcc162dc12d1079c7a14dc9a5b23b2b3e351555d7f10a8	-	ol10_aarch64_appstream
	nodejs-npm-10.9.8-1.22.23.1.4.el10_2.aarch64.rpm	363c170fd5bf7eac9915ec4ad2b461ed6e62f75eb50534e96d65ebe766a0f502	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	nodejs22-22.23.1-4.el10_2.src.rpm	5bc1f0242046dadedc307f899a81fc6282111de17dbb9763df519280cc2c7d77	-	ol10_x86_64_appstream
	nodejs-22.23.1-4.el10_2.x86_64.rpm	f3dce33d07031b755f4185a05a4ab6d946d8ea36242fcb7688b3ff7e2c1c04d0	-	ol10_x86_64_appstream
	nodejs-devel-22.23.1-4.el10_2.x86_64.rpm	b5cd57f60b262e2d74a78619c81e15cb537a342ff46c4e548aa3c91ad6b5a014	-	ol10_x86_64_appstream
	nodejs-docs-22.23.1-4.el10_2.noarch.rpm	033bbc907b2e39f54c4d8dd353b4d039446ec79d4d6f21a0c06a8a9ca62d0fc0	-	ol10_x86_64_appstream
	nodejs-full-i18n-22.23.1-4.el10_2.x86_64.rpm	c930edd8f6e7d07db51ed03e3fce40e53e1732630828b6e881e0c6d3685eddc9	-	ol10_x86_64_appstream
	nodejs-libs-22.23.1-4.el10_2.x86_64.rpm	fe40cbcd1fcec1f2232acb9e0b70cb26eb366e5ad87e9a8b5f72773d46b22cc7	-	ol10_x86_64_appstream
	nodejs-npm-10.9.8-1.22.23.1.4.el10_2.x86_64.rpm	b5f8fbae7804b6ac12a207a1e6eddbd0848f8a8c44172ad9ce2e91ed4dbbf94f	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team