ELSA-2026-47059

ELSA-2026-47059 - nodejs:22 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-29

Description

nodejs
[1:22.23.1-2]
- Backport patches for various CVEs
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-193842 RHEL-193874 RHEL-208661

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-176170
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
Resolves: RHEL-154019
Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118152

[1:22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-100424

[1:22.16.0-2]
- Patch fix for sqlite CVE-2025-6965
Resolves: RHEL-103835

[1:22.16.0-1]
- Update to 22.16.0
Fixes: CVE-2025-23166
- Resolves: RHEL-91596 RHEL-92859

[1:22.15.0-1]
- Update to 22.15.0
- Drop upstream patches

[1:22.13.1-4]
- Patch fix for sqlite CVE-2025-31498
Resolves: RHEL-87300

[1:22.13.1-3]
- Update c-ares to newest version with fix for CVE-2025-31498
Resolves: RHEL-86581

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Switch from using remys fork as a source to npm.
- Resolves: RHEL-208659

[3.0.1-1]
- Exclude ix86 arches from building.
Related: RHEL-35991

[3.0.1-1]
- Rebase to 3.0.1
- Resolves: CVE-2022-25883

[2.0.20-2]
- Patch bundled glob-parent
- Resolves: CVE-2021-35065

[2.0.20-1]
- Rebase to 2.0.20
Resolves: CVE-2022-3517

[2.0.15-1]
- Resolves: RHBZ#2005419
- Resolves CVE-2020-28469
- Rebase to newest version
- Change source to npmjs.com

[2.0.7-1]
- Resolves: RHBZ#1953991
- Update to 2.0.7 to resolve CVE-2020-28469

[2.0.3-1]
- Updated

[1.18.3-1]
- Resolves: #1615413
- Updated
- bundled

[1.11.0-2]
- rh-nodejs8 rebuild

nodejs-packaging
[2021.06-4]
- Exclude ix86 arches from building.
Related: RHEL-35991

[2021.06-4]
- NPM bundler: also find namespaced bundled dependencies

[2021.06-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

[2021.06-2]
- Fix hard-coded output directory in the bundler

[2021.06-1]
- Update to 2021.06-1
- bundler: Handle archaic license metadata
- bundler: Warn about bundled dependencies with no license metadata

[2021.01-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[2021.01-2]
- nodejs-packaging-bundler improvements to handle uncommon characters

[2021.01]
- Add nodejs-packaging-bundler and update README.md

[2020.09-1]
- Move to dist-git as the upstream

[25-1]
- Fix incorrect bundled library detection for Requires

Related CVEs

CVE-2026-13149

CVE-2026-59873

CVE-2026-59874

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	nodejs-22.23.1-2.module+el8.10.0+90976+97994de0.src.rpm	01091cad9de5e8a5d0111e7238259646ed623dab5c648f01d05bdecca08eb648	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90976+97994de0.src.rpm	6ca9ea84ef9e20ae7daef5481d16a5eee4d07541d0f0f976460e845a0929bc49	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.src.rpm	4f73026112220e0246e46e0c2464332067ef0ccc161764686dbe16debcf8e694	-	ol8_aarch64_appstream
	nodejs-22.23.1-2.module+el8.10.0+90976+97994de0.aarch64.rpm	b630a54f9c30be1d77741f2937ef211758573575a82befd55dfeb7e93b266ae7	-	ol8_aarch64_appstream
	nodejs-devel-22.23.1-2.module+el8.10.0+90976+97994de0.aarch64.rpm	1b06a410c0e4241cbd80733a9a4e1c244de63762996fec8868a9da06d9a1e94d	-	ol8_aarch64_appstream
	nodejs-docs-22.23.1-2.module+el8.10.0+90976+97994de0.noarch.rpm	aa4be280a1ab85cfb1f0d0dd236ad1dc96084cb81c203df1b439844d7829b435	-	ol8_aarch64_appstream
	nodejs-full-i18n-22.23.1-2.module+el8.10.0+90976+97994de0.aarch64.rpm	dd770abe0f899169a91ac9583465bf36e5c93697bfd8308e61f348b1f80a831d	-	ol8_aarch64_appstream
	nodejs-libs-22.23.1-2.module+el8.10.0+90976+97994de0.aarch64.rpm	41b6bc61d1cd411396d39005f57b9fff068b5b2bfd98844d404b1a0b766b274a	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90976+97994de0.noarch.rpm	a7b75a5a60ebafd5ec3d48884b5c3b1d7652144fe82e99cc1360dfa4eeab4097	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	1f7d77d004b65a13c3c060facb8c7f9d1cdc64be2da58b060b54db225facecc7	-	ol8_aarch64_appstream
	nodejs-packaging-bundler-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	34f7710f3e76f7c8462c6a0706565b5f6189a8e49dc839606f7e3b2f942969e5	-	ol8_aarch64_appstream
	npm-10.9.8-1.22.23.1.2.module+el8.10.0+90976+97994de0.aarch64.rpm	62ed421f7579339e72cc6bfa3f0785d15dcd8972d719118229fb4de96e5e75b8	-	ol8_aarch64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el8.10.0+90976+97994de0.aarch64.rpm	8a62c7f21427896bfa8a7a2f180ad32e2de5e13c93ea08debe35c40f9397bb0e	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	nodejs-22.23.1-2.module+el8.10.0+90976+97994de0.src.rpm	01091cad9de5e8a5d0111e7238259646ed623dab5c648f01d05bdecca08eb648	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90976+97994de0.src.rpm	6ca9ea84ef9e20ae7daef5481d16a5eee4d07541d0f0f976460e845a0929bc49	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.src.rpm	4f73026112220e0246e46e0c2464332067ef0ccc161764686dbe16debcf8e694	-	ol8_x86_64_appstream
	nodejs-22.23.1-2.module+el8.10.0+90976+97994de0.x86_64.rpm	661c59aef8d4360d94cff1881d2fd10e08a1086abbffcd4e66b748212d1cfe46	-	ol8_x86_64_appstream
	nodejs-devel-22.23.1-2.module+el8.10.0+90976+97994de0.x86_64.rpm	265d305118fad804a369dabe95846a79dfea16667859313fc4e94e159e6a1b3a	-	ol8_x86_64_appstream
	nodejs-docs-22.23.1-2.module+el8.10.0+90976+97994de0.noarch.rpm	aa4be280a1ab85cfb1f0d0dd236ad1dc96084cb81c203df1b439844d7829b435	-	ol8_x86_64_appstream
	nodejs-full-i18n-22.23.1-2.module+el8.10.0+90976+97994de0.x86_64.rpm	cd9815b9c5d6cd65509106002948ee698cc1417082989fb69d0f852edfd05917	-	ol8_x86_64_appstream
	nodejs-libs-22.23.1-2.module+el8.10.0+90976+97994de0.x86_64.rpm	8850fdf4c2ac982f5f6208fd5ec0dba0ab3309962e90efdeb45b2f9607245694	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90976+97994de0.noarch.rpm	a7b75a5a60ebafd5ec3d48884b5c3b1d7652144fe82e99cc1360dfa4eeab4097	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	1f7d77d004b65a13c3c060facb8c7f9d1cdc64be2da58b060b54db225facecc7	-	ol8_x86_64_appstream
	nodejs-packaging-bundler-2021.06-4.module+el8.10.0+90968+e271b286.noarch.rpm	34f7710f3e76f7c8462c6a0706565b5f6189a8e49dc839606f7e3b2f942969e5	-	ol8_x86_64_appstream
	npm-10.9.8-1.22.23.1.2.module+el8.10.0+90976+97994de0.x86_64.rpm	1f342e770dc7d5157adbc86c1d95c5e1a87344fd75a7e885a25640fecaac9680	-	ol8_x86_64_appstream
	v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el8.10.0+90976+97994de0.x86_64.rpm	795e6d53fbbe419beb7c65e28fc1564fdf2556489c5a70e26fbdb05075346039	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team