ELSA-2026-54530

ELSA-2026-54530 - nodejs:22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-14

Description

nodejs
[1:22.23.1-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 2.1.4
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152

[1:22.23.1-3]
- Backport patch: update sqlite to 3.53.4
Fix: CVE-2026-11824, CVE-2026-11822
Resolves: RHEL-224135 RHEL-224144

[1:22.23.1-2]
- Backport patches for various CVEs
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-193842 RHEL-193874 RHEL-208661

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-176170
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
Resolves: RHEL-154019
Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118152

[1:22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-100424

[1:22.16.0-2]
- Patch fix for sqlite CVE-2025-6965
Resolves: RHEL-103835

[1:22.16.0-1]
- Update to 22.16.0
Fixes: CVE-2025-23166
- Resolves: RHEL-91596 RHEL-92859

[1:22.15.0-1]
- Update to 22.15.0
- Drop upstream patches

nodejs-nodemon
[3.1.14-2]
- Rebase npm/brace-expansion to 5.0.9
Fixes: CVE-2026-69152
Resolves: RHEL-223760

[3.1.14-1]
- Rebase to 3.1.14
- Switch from using remys fork as a source to npm.
- Resolves: RHEL-208659

[3.0.1-1]
- Exclude ix86 arches from building.
Related: RHEL-35991

[3.0.1-1]
- Rebase to 3.0.1
- Resolves: CVE-2022-25883

[2.0.20-2]
- Patch bundled glob-parent
- Resolves: CVE-2021-35065

[2.0.20-1]
- Rebase to 2.0.20
Resolves: CVE-2022-3517

[2.0.15-1]
- Resolves: RHBZ#2005419
- Resolves CVE-2020-28469
- Rebase to newest version
- Change source to npmjs.com

[2.0.7-1]
- Resolves: RHBZ#1953991
- Update to 2.0.7 to resolve CVE-2020-28469

[2.0.3-1]
- Updated

[1.18.3-1]
- Resolves: #1615413
- Updated
- bundled

nodejs-packaging
[2021.06-4]
- Exclude ix86 arches from building.
Related: RHEL-35991

[2021.06-4]
- NPM bundler: also find namespaced bundled dependencies

[2021.06-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

[2021.06-2]
- Fix hard-coded output directory in the bundler

[2021.06-1]
- Update to 2021.06-1
- bundler: Handle archaic license metadata
- bundler: Warn about bundled dependencies with no license metadata

[2021.01-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[2021.01-2]
- nodejs-packaging-bundler improvements to handle uncommon characters

[2021.01]
- Add nodejs-packaging-bundler and update README.md

[2020.09-1]
- Move to dist-git as the upstream

[25-1]
- Fix incorrect bundled library detection for Requires

Related CVEs

CVE-2026-11822

CVE-2026-11824

CVE-2026-14257

CVE-2026-69152

CVE-2026-69192

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	nodejs-22.23.1-3.module+el8.10.0+90989+141244df.src.rpm	ebe4bb99235d75f40dd1b50775f8e543248279b1e34a440fbdb2a1b9f9122570	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el8.10.0+90989+141244df.src.rpm	9d60cfbb7f76dcd9f4bdbf5525d2dd84dcd2145d5a4d2dd7f9096bae7e71b668	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.src.rpm	4f73026112220e0246e46e0c2464332067ef0ccc161764686dbe16debcf8e694	-	ol8_aarch64_appstream
	nodejs-22.23.1-3.module+el8.10.0+90989+141244df.aarch64.rpm	e82246dd9fbcbd01141bdbe5cc226d158f01c3923c3579f01539cb6b7c1867a1	-	ol8_aarch64_appstream
	nodejs-devel-22.23.1-3.module+el8.10.0+90989+141244df.aarch64.rpm	9f34f22005e8b828cb19200cfdffb6ac4ef9b64302d8cca2bd974502d415655c	-	ol8_aarch64_appstream
	nodejs-docs-22.23.1-3.module+el8.10.0+90989+141244df.noarch.rpm	c5a02e641d5e38e6b7bb2bd53d9e23aac7fe704e047b6a30341a31f8f5863f90	-	ol8_aarch64_appstream
	nodejs-full-i18n-22.23.1-3.module+el8.10.0+90989+141244df.aarch64.rpm	ec2fdef07eb126d21da1c9866d1fb8ea73c7e9aa01c4a347e923dbc09767539a	-	ol8_aarch64_appstream
	nodejs-libs-22.23.1-3.module+el8.10.0+90989+141244df.aarch64.rpm	c2be7d56e836681bf4ea72f46066d5f5ec16e277adb10710561fa70b13297ffb	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el8.10.0+90989+141244df.noarch.rpm	278e527da1bfb213015a82a6ab405a54663c84f18769bb54908067f41b10fe37	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	1f7d77d004b65a13c3c060facb8c7f9d1cdc64be2da58b060b54db225facecc7	-	ol8_aarch64_appstream
	nodejs-packaging-bundler-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	34f7710f3e76f7c8462c6a0706565b5f6189a8e49dc839606f7e3b2f942969e5	-	ol8_aarch64_appstream
	npm-10.9.8-1.22.23.1.3.module+el8.10.0+90989+141244df.aarch64.rpm	2ec8be24c7aeef8ddbc567d543416beba1710a57d5da3f628638025576b44de7	-	ol8_aarch64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.3.module+el8.10.0+90989+141244df.aarch64.rpm	79e8c6af38e8903b79ba5e2f141c8d5255feb52dba86568756dccb7fffccb55e	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	nodejs-22.23.1-3.module+el8.10.0+90989+141244df.src.rpm	ebe4bb99235d75f40dd1b50775f8e543248279b1e34a440fbdb2a1b9f9122570	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el8.10.0+90989+141244df.src.rpm	9d60cfbb7f76dcd9f4bdbf5525d2dd84dcd2145d5a4d2dd7f9096bae7e71b668	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.src.rpm	4f73026112220e0246e46e0c2464332067ef0ccc161764686dbe16debcf8e694	-	ol8_x86_64_appstream
	nodejs-22.23.1-3.module+el8.10.0+90989+141244df.x86_64.rpm	8ec3d05270f9a852b285c2fcd0f3c0da357a8c41ac54366e010329e66c591144	-	ol8_x86_64_appstream
	nodejs-devel-22.23.1-3.module+el8.10.0+90989+141244df.x86_64.rpm	e1a1ea027a2c9486f9d350224d843006505fa618127b77355c2e5dc0ba0ede7e	-	ol8_x86_64_appstream
	nodejs-docs-22.23.1-3.module+el8.10.0+90989+141244df.noarch.rpm	c5a02e641d5e38e6b7bb2bd53d9e23aac7fe704e047b6a30341a31f8f5863f90	-	ol8_x86_64_appstream
	nodejs-full-i18n-22.23.1-3.module+el8.10.0+90989+141244df.x86_64.rpm	9f6e9729306a07add687524eb1aafa23102e9fc403220bdc27382e20012d1ec0	-	ol8_x86_64_appstream
	nodejs-libs-22.23.1-3.module+el8.10.0+90989+141244df.x86_64.rpm	4b9301c9d3c97e92fc3ed2161ae730ae0691b83bbb81687d5dbca23e3d555a31	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el8.10.0+90989+141244df.noarch.rpm	278e527da1bfb213015a82a6ab405a54663c84f18769bb54908067f41b10fe37	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	1f7d77d004b65a13c3c060facb8c7f9d1cdc64be2da58b060b54db225facecc7	-	ol8_x86_64_appstream
	nodejs-packaging-bundler-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	34f7710f3e76f7c8462c6a0706565b5f6189a8e49dc839606f7e3b2f942969e5	-	ol8_x86_64_appstream
	npm-10.9.8-1.22.23.1.3.module+el8.10.0+90989+141244df.x86_64.rpm	ba927982ac438dec608dc2df4719cd4521dffa620123ca0be1d2e9c858600d7f	-	ol8_x86_64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.3.module+el8.10.0+90989+141244df.x86_64.rpm	cbcfa5a1898d376551966d6821e3688d5acc26822a2605d3c6a221ce4ed2b1c2	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team