ELSA-2026-55603

ELSA-2026-55603 - nodejs:24 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-18

Description

nodejs
[1:24.18.0-6]
- Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149
(memory exhaustion via deeply chained brace groups). as well as
CVE-2026-14257 (fixed in 5.0.8).

[1:24.18.0-5]
- Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address

[1:24.18.0-4]
- deps: update sqlite to 3.53.4

[1:24.18.0-3]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar

[1:24.18.0-2]
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion

[1:24.18.0-1]
- Update to version 24.18.0

[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1

[1:24.14.1-1]
- Update to version 24.14.1

[1:24.13.0-1]
- Update to version 24.13.0

[1:24.11.1-2]
- Disable test-tls-session-cache.js as its not currently compatiable with
RHEL environment

nodejs-nodemon
[3.1.14-3]
- Fix CVE-2026-69152 - brace-expansion

[3.1.14-2]
- Correction to sources for 3.1.14.

[3.1.14-1]
- Update to version 3.1.14

[3.0.3-3]
- Keep BR on just npm

[3.0.3-2]
- Fix BR for nodejs-npm

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121569

[2021.06-5]
- nodejs.req to properly detect bundled deps

Related CVEs

CVE-2026-11822

CVE-2026-11824

CVE-2026-14257

CVE-2026-54272

CVE-2026-69152

CVE-2026-69192

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nodejs-24.18.0-6.module+el9.8.0+90993+075b4fd6.src.rpm	5bd09051e2f858e753a0efedfc018e65c551982e7aa167b2fc54615552660608	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-3.module+el9.8.0+90993+075b4fd6.src.rpm	951c4a87ed2f62b307135e573d0891cd372919fc528f53e57ad9d657f921914a	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.src.rpm	3e609d717f6038e78b086b242cb7a67b2f08e537d00372eed01295497a369686	-	ol9_aarch64_appstream
	nodejs-24.18.0-6.module+el9.8.0+90993+075b4fd6.aarch64.rpm	986618f6502c5f2a38341b2e578c96483b90cf249e581896b38c6f9327fa0240	-	ol9_aarch64_appstream
	nodejs-devel-24.18.0-6.module+el9.8.0+90993+075b4fd6.aarch64.rpm	f438e2be65f3704e90b407dc22a3ebc995d13ec5a39cbe7a7a94b5ee1355e326	-	ol9_aarch64_appstream
	nodejs-docs-24.18.0-6.module+el9.8.0+90993+075b4fd6.noarch.rpm	fee3c91d00d7a3147f28038d7b07c007db6e4c0944a4655221aa9b7d1712f5ad	-	ol9_aarch64_appstream
	nodejs-full-i18n-24.18.0-6.module+el9.8.0+90993+075b4fd6.aarch64.rpm	74d9e742a30d4a3e974e51f2d0385464203e0b6e8ba1e43bd289d23388421a3d	-	ol9_aarch64_appstream
	nodejs-libs-24.18.0-6.module+el9.8.0+90993+075b4fd6.aarch64.rpm	b8a6959a2d1d212e7427995c781c5b807eb1dfdbe77a4b90dd6eb15351cad4a6	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-3.module+el9.8.0+90993+075b4fd6.noarch.rpm	41c3faf8c02ddf859d6a1f2dcba6757baa27f3cda06ea88712d6cdf7c722f7bd	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	485f612fb14ad0dcc61fe2dbbe427fa78b59cb9350946740bc1cbe504b657546	-	ol9_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	498c5fb6cf7e4834b23849a0ef21f8286407866600f75fd3a69330f548fcbf28	-	ol9_aarch64_appstream
	npm-11.16.0-1.24.18.0.6.module+el9.8.0+90993+075b4fd6.noarch.rpm	b58d846f62479bd6209fe54bf092c86aeb04339d8626d08f3eb3e7fc9bf1119d	-	ol9_aarch64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6.aarch64.rpm	faf45c93971f71b9b70946fc5d786286f7460e9e36058a98ed4f186779fa4edf	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nodejs-24.18.0-6.module+el9.8.0+90993+075b4fd6.src.rpm	5bd09051e2f858e753a0efedfc018e65c551982e7aa167b2fc54615552660608	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-3.module+el9.8.0+90993+075b4fd6.src.rpm	951c4a87ed2f62b307135e573d0891cd372919fc528f53e57ad9d657f921914a	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.src.rpm	3e609d717f6038e78b086b242cb7a67b2f08e537d00372eed01295497a369686	-	ol9_x86_64_appstream
	nodejs-24.18.0-6.module+el9.8.0+90993+075b4fd6.x86_64.rpm	30d96f7096c8df899c9e8e3d337a350c7e49ca50761b32bb7f1564898c7b62b6	-	ol9_x86_64_appstream
	nodejs-devel-24.18.0-6.module+el9.8.0+90993+075b4fd6.x86_64.rpm	71b6a1f4eedf4587b0120e9b6dcc85aecc15a1641f7c4ce56b59d1a0d98a65ee	-	ol9_x86_64_appstream
	nodejs-docs-24.18.0-6.module+el9.8.0+90993+075b4fd6.noarch.rpm	fee3c91d00d7a3147f28038d7b07c007db6e4c0944a4655221aa9b7d1712f5ad	-	ol9_x86_64_appstream
	nodejs-full-i18n-24.18.0-6.module+el9.8.0+90993+075b4fd6.x86_64.rpm	d96b477901e176a70fbd76fced77ef083ea3aa9d57ddad45203b9737c499ab04	-	ol9_x86_64_appstream
	nodejs-libs-24.18.0-6.module+el9.8.0+90993+075b4fd6.x86_64.rpm	90fbcc17c34fc7c32306ffacd8ed1ef5dfcaca56cb5c5a68c7ebeb7b1de5ba26	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-3.module+el9.8.0+90993+075b4fd6.noarch.rpm	41c3faf8c02ddf859d6a1f2dcba6757baa27f3cda06ea88712d6cdf7c722f7bd	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	485f612fb14ad0dcc61fe2dbbe427fa78b59cb9350946740bc1cbe504b657546	-	ol9_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90946+13dc792a.noarch.rpm	498c5fb6cf7e4834b23849a0ef21f8286407866600f75fd3a69330f548fcbf28	-	ol9_x86_64_appstream
	npm-11.16.0-1.24.18.0.6.module+el9.8.0+90993+075b4fd6.noarch.rpm	b58d846f62479bd6209fe54bf092c86aeb04339d8626d08f3eb3e7fc9bf1119d	-	ol9_x86_64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6.x86_64.rpm	8aa4c5d01df2fddf643b21ceb07f8dc6e460fede6e2d3c33499476caadad8b8b	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team