ELSA-2026-47058

ELSA-2026-47058 - nodejs:22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-29

Description

nodejs
[1:22.23.1-2]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-186622 RHEL-185998 RHEL-183669
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
Resolves: RHEL-163370
Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118153

[1.22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-111913

[1:22.16.0-2]
- Patch fix for CVE-2025-6965
Resolves: RHEL-103853

[1:22.16.0-1]
- Update to 22.16.0
Resolves: RHEL-92870 RHEL-89599 RHEL-92058

[1:22.15.0-1]
- Update to 22.15.0
- Drop upstream patches

[1:22.13.1-4]
- Patch fix for sqlite CVE-2025-31498
Resolves: RHEL-87320

[1:22.13.1-3]
- Update c-ares to newest version with fix for CVE-2025-31498
Resolves: RHEL-86587

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Change
%setup -q




/usr/bin/cat /builddir/build/SOURCES/0001-deps-glob-parent-Resolve-ReDoS-vulnerability-from-CV.patch |
/usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch


- Resolves: RHEL-208677

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-120511

[2021.06-5]
- nodejs.req to properly detect bundled deps

Related CVEs

CVE-2026-13149

CVE-2026-59873

CVE-2026-59874

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nodejs-22.23.1-2.module+el9.8.0+90973+e42b55e7.src.rpm	89f3e5c3d379dd304c492425cd26d7828ce3506ddc440924a891d242305b4e12	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el9.8.0+90973+e42b55e7.src.rpm	95780ccec7ddbf7b619cbf0b67b8be9312e496cb89a9e0e3b40aae11abb56623	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90973+e42b55e7.src.rpm	a9ca6b3111e938ca5b219910d8ee4ee69d80abdad8d5c91a04c43f0fc7c86cf8	-	ol9_aarch64_appstream
	nodejs-22.23.1-2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	06118eb038c47d8ac494844d788b899ca099bc0f13f210cea203f863db578931	-	ol9_aarch64_appstream
	nodejs-devel-22.23.1-2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	3d0b77f75dab9f9e7b8d1aba298c586de60b25d9bd44f7a2bb7fb584e3d447f4	-	ol9_aarch64_appstream
	nodejs-docs-22.23.1-2.module+el9.8.0+90973+e42b55e7.noarch.rpm	fd19db305e4f6aa54e49ad9e53b079168d5812ab73820f3c5f180f0935c028e5	-	ol9_aarch64_appstream
	nodejs-full-i18n-22.23.1-2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	400f6f01244bbd11b46571b15b1c8d171ebf281f52fc7279d2ed0a208daa2e9f	-	ol9_aarch64_appstream
	nodejs-libs-22.23.1-2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	38f7b4b34b6d329253447a26cb63df7861c55dbfbb9e7d586c12d46a50e4fec0	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el9.8.0+90973+e42b55e7.noarch.rpm	16163c2317b01bda182786c95fe2a91caaf253d398cad27ae24ae59a89e9d1b9	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90973+e42b55e7.noarch.rpm	06af359fb18275a207f355db99274f46fd13dde22fcea8a6a70d905b4e983d05	-	ol9_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90973+e42b55e7.noarch.rpm	5b28809f4309cf479c702577bcc659fabf5be895307d38d80f5408a7583f5243	-	ol9_aarch64_appstream
	npm-10.9.8-1.22.23.1.2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	ae04ca6ad8c691ad4e2a6fbe08dace42ef668197a30e4f8a9adb2c2ed37284f3	-	ol9_aarch64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el9.8.0+90973+e42b55e7.aarch64.rpm	011f78f81936b26bb52fb7eb6110395e74aa37ec402eac3a31d6495437e42474	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nodejs-22.23.1-2.module+el9.8.0+90973+e42b55e7.src.rpm	89f3e5c3d379dd304c492425cd26d7828ce3506ddc440924a891d242305b4e12	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el9.8.0+90973+e42b55e7.src.rpm	95780ccec7ddbf7b619cbf0b67b8be9312e496cb89a9e0e3b40aae11abb56623	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90973+e42b55e7.src.rpm	a9ca6b3111e938ca5b219910d8ee4ee69d80abdad8d5c91a04c43f0fc7c86cf8	-	ol9_x86_64_appstream
	nodejs-22.23.1-2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	fafb9d2a9e1d5983b54894d7af652e84fda9449677267aeb0509276158ec6b8f	-	ol9_x86_64_appstream
	nodejs-devel-22.23.1-2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	d893816132e6c4062ecddd3481cf234808f7c08da3e64a83116014b085603bca	-	ol9_x86_64_appstream
	nodejs-docs-22.23.1-2.module+el9.8.0+90973+e42b55e7.noarch.rpm	fd19db305e4f6aa54e49ad9e53b079168d5812ab73820f3c5f180f0935c028e5	-	ol9_x86_64_appstream
	nodejs-full-i18n-22.23.1-2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	b4508b9c1388a990dc2faaa8f26c80f0bd5c70a4c7c3486e7b9b8db873efb1c4	-	ol9_x86_64_appstream
	nodejs-libs-22.23.1-2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	9fb6b51893a598de591172eca8ccbe9aa56148053b0ec715c892eae5231b153c	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el9.8.0+90973+e42b55e7.noarch.rpm	16163c2317b01bda182786c95fe2a91caaf253d398cad27ae24ae59a89e9d1b9	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+90973+e42b55e7.noarch.rpm	06af359fb18275a207f355db99274f46fd13dde22fcea8a6a70d905b4e983d05	-	ol9_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+90973+e42b55e7.noarch.rpm	5b28809f4309cf479c702577bcc659fabf5be895307d38d80f5408a7583f5243	-	ol9_x86_64_appstream
	npm-10.9.8-1.22.23.1.2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	2848922d5392ccf482fcd5f1cf1cb3fba662b7f85c78dfe9102d8f3e1dff7f24	-	ol9_x86_64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el9.8.0+90973+e42b55e7.x86_64.rpm	79a1b9501aefd04a8ea7e0292c14ba355c008dcba55a3a887b55cad2a1b73fbc	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team