ELSA-2026-55541

ELSA-2026-55541 - nodejs22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-17

Description

[1:22.23.1-4.0.1]
- Add c-ares as dependency [orabug 39781219]

[1:22.23.1-6]
- Fix for CVE-2026-69152

[1:22.23.1-5]
- Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address

[1:22.23.1-4]
- Fix CVE-2026-13149 (npm/brace-expansion)

[1:22.23.1-3]
- Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar)

[1:22.23.1-2]
- CVE-2026-42338 ip-address HTML escaping fix.

[1:22.23.1-1]
- Update to version 22.23.1

[1:22.22.2-2]
- De-bundle c-ares, libuv
- we waited for c-ares for about 4 months, so added conditional flag in
case it falls behind in future again, same for libuv

[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547

[1:22.22.0-4]
- sources: changed ICU version syntax

Related CVEs

CVE-2026-14257

CVE-2026-69152

CVE-2026-69192

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nodejs22-22.23.1-6.0.1.el10_2.src.rpm	57f3abf9e2f684ab5952488ed3d3b0f2ac37a4fa22c22041f32529762eb2a410	-	ol10_aarch64_appstream
	nodejs-22.23.1-6.0.1.el10_2.aarch64.rpm	ac7b7d07f43ffed3fc16f212bcc82fa056e5b0b013a497e41d2cdc752490033a	-	ol10_aarch64_appstream
	nodejs-devel-22.23.1-6.0.1.el10_2.aarch64.rpm	8e37444824cee62311e9ef2eb9275932416d79998261e8eb50ed5b9d2a75ccc5	-	ol10_aarch64_appstream
	nodejs-docs-22.23.1-6.0.1.el10_2.noarch.rpm	8ea9b56e8d40e6679a1582a621a33e1904d9a7da220cf6dfee31cb93235dbc03	-	ol10_aarch64_appstream
	nodejs-full-i18n-22.23.1-6.0.1.el10_2.aarch64.rpm	15e0b1faf428c9aae5d0628fb2262efd11d6d9b986d414f5770d16f96df25274	-	ol10_aarch64_appstream
	nodejs-libs-22.23.1-6.0.1.el10_2.aarch64.rpm	8e64249efefab8ed43aff6a9ba67b3b9f9b01c94049668627a9350944b62b558	-	ol10_aarch64_appstream
	nodejs-npm-10.9.8-1.22.23.1.6.0.1.el10_2.aarch64.rpm	7512ef192298edc9561063d24f0182b172c6df04c32350aaf80e5058e6db6a0f	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	nodejs22-22.23.1-6.0.1.el10_2.src.rpm	57f3abf9e2f684ab5952488ed3d3b0f2ac37a4fa22c22041f32529762eb2a410	-	ol10_x86_64_appstream
	nodejs-22.23.1-6.0.1.el10_2.x86_64.rpm	99959714346303c4db6654dcf050c42490cdaa541428f2b29f6b855c9bed86fd	-	ol10_x86_64_appstream
	nodejs-devel-22.23.1-6.0.1.el10_2.x86_64.rpm	7e2a594c6ba1adba0ff41711ddfaf0bb0a3cb49fe5d84c5dededff932266d070	-	ol10_x86_64_appstream
	nodejs-docs-22.23.1-6.0.1.el10_2.noarch.rpm	8ea9b56e8d40e6679a1582a621a33e1904d9a7da220cf6dfee31cb93235dbc03	-	ol10_x86_64_appstream
	nodejs-full-i18n-22.23.1-6.0.1.el10_2.x86_64.rpm	2ac848f7a250659894ad16b67ff1ef489cc33efcca58717177a35df916c2b55d	-	ol10_x86_64_appstream
	nodejs-libs-22.23.1-6.0.1.el10_2.x86_64.rpm	6c021c091bfc8368e5a5db1efa5fa4a1fef338d07d5238f4e500809fa24d38b2	-	ol10_x86_64_appstream
	nodejs-npm-10.9.8-1.22.23.1.6.0.1.el10_2.x86_64.rpm	7557533d9416d0da1fcbd0439e187b6d34495116c440b1425d0cf3e8748d5286	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team