ELSA-2026-76750

ELSA-2026-76750 - nodejs:22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-11

Description

nodejs
[1:22.23.2-2]
- Patches Pacote CVE and update undici to 6.28.1
Fixes: CVE-2026-9496 CVE-2026-19534
Resolves: RHEL-259889 RHEL-255272

[1:22.23.2-1]
- Update to version 22.23.2
Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043
Resolves: RHEL-234381 RHEL-234831 RHEL-234896

[1:22.23.1-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 2.1.4
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
Resolves: RHEL-223914 RHEL-223798

[1:22.23.1-3]
- deps: update sqlite to 3.53.4
Fix: CVE-2026-11824, CVE-2026-11822

[1:22.23.1-2]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-186622 RHEL-185998 RHEL-183669
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
Resolves: RHEL-163370
Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118153

[1.22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-111913

[1:22.16.0-2]
- Patch fix for CVE-2025-6965
Resolves: RHEL-103853

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Change
%setup -q




/usr/bin/cat /builddir/build/SOURCES/0001-deps-glob-parent-Resolve-ReDoS-vulnerability-from-CV.patch |
/usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch


- Resolves: RHEL-208677

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-120511

[2021.06-5]
- nodejs.req to properly detect bundled deps

Related CVEs

CVE-2026-19534

CVE-2026-9496

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nodejs-22.23.2-2.module+el9.8.0+91062+a7d6b802.src.rpm	eaaef973ffbdee41f5141b7e3bd1dc6225361fbf30b9b5729a89c9ecfa86af4c	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+91010+e0f4f255.src.rpm	77d3c807612130bfe940e4a16766416ad1b3ea321cd92efbebfe2cc3053f862d	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.src.rpm	6d341ed26e1268fbf465ce25d3b1f1d4eb4d12830958f909af2ce649030d76f6	-	ol9_aarch64_appstream
	nodejs-22.23.2-2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	ddae12ab4ba82f759542ba8152d246bed5c9733e3e3685aeb43fc395426649fa	-	ol9_aarch64_appstream
	nodejs-devel-22.23.2-2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	cbff2787c8154d15052d72127292eeb03d1ffc1dec767bdefb22892d5e991687	-	ol9_aarch64_appstream
	nodejs-docs-22.23.2-2.module+el9.8.0+91062+a7d6b802.noarch.rpm	41de721572d1f2a32c4bff5bddd9e2cdec6b6e45409a9727d982fe888e15fa05	-	ol9_aarch64_appstream
	nodejs-full-i18n-22.23.2-2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	7da02fac3eb8a05458e9d2ca1290cbd07e69f03928d3b38262b66f9e47b27234	-	ol9_aarch64_appstream
	nodejs-libs-22.23.2-2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	64e4b2c408bfa81dc2e1458a71ccfa990c40804c3bdb35be4e1de9ad4b241134	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+91010+e0f4f255.noarch.rpm	f3814a67931fdd04596242a0162d3ba08b15cc55e42a3080b8f999fd19b553c1	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm	99f5d90350bc1ba909c679601562085a52fb0ff3f05fef90c2d210efbb7829e0	-	ol9_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm	d50e4f118178582c30d8143a94c1feee61b963e55783188e51ef038a60d8e0f0	-	ol9_aarch64_appstream
	npm-10.9.8-1.22.23.2.2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	1b55e96979cb85b668b43d63b12ad3e676ab12074d9765ddfae436da2010343c	-	ol9_aarch64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.2.2.module+el9.8.0+91062+a7d6b802.aarch64.rpm	40c5da89c35aaf6adbd9d470a008395b7202359598c5711a636fc7ae1c782a9d	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nodejs-22.23.2-2.module+el9.8.0+91062+a7d6b802.src.rpm	eaaef973ffbdee41f5141b7e3bd1dc6225361fbf30b9b5729a89c9ecfa86af4c	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+91010+e0f4f255.src.rpm	77d3c807612130bfe940e4a16766416ad1b3ea321cd92efbebfe2cc3053f862d	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.src.rpm	6d341ed26e1268fbf465ce25d3b1f1d4eb4d12830958f909af2ce649030d76f6	-	ol9_x86_64_appstream
	nodejs-22.23.2-2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	5a61a02ada17f34741797f5e48520cef0cd2b4b45aaec1ff0ce9aaffbe9e8075	-	ol9_x86_64_appstream
	nodejs-devel-22.23.2-2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	7d80330f1f09a162c8d560e7f122842c50e3c8413262f35f8847052247b5be9f	-	ol9_x86_64_appstream
	nodejs-docs-22.23.2-2.module+el9.8.0+91062+a7d6b802.noarch.rpm	41de721572d1f2a32c4bff5bddd9e2cdec6b6e45409a9727d982fe888e15fa05	-	ol9_x86_64_appstream
	nodejs-full-i18n-22.23.2-2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	445ee95788777400476c3ae7e816bff7e265dfae245c3aafb8da56d65a974c50	-	ol9_x86_64_appstream
	nodejs-libs-22.23.2-2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	cfd7d5f888e390f0f4ee25f1b9fd0d5c16f1eb20dff7e60b76a6cca1874683e5	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-2.module+el9.8.0+91010+e0f4f255.noarch.rpm	f3814a67931fdd04596242a0162d3ba08b15cc55e42a3080b8f999fd19b553c1	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm	99f5d90350bc1ba909c679601562085a52fb0ff3f05fef90c2d210efbb7829e0	-	ol9_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm	d50e4f118178582c30d8143a94c1feee61b963e55783188e51ef038a60d8e0f0	-	ol9_x86_64_appstream
	npm-10.9.8-1.22.23.2.2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	02fb2a2276be2c1782d8a5f897ddc4b33b87222c698a3200f65d2a5a7a6a7ca7	-	ol9_x86_64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.2.2.module+el9.8.0+91062+a7d6b802.x86_64.rpm	fd4ac2ae08a58dfb3e75c6f0bdda91d90b1ff4ece838388ae763ceb033490f4d	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team