ELSA-2026-47060

ELSA-2026-47060 - nodejs:24 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-29

Description

nodejs
[1:24.18.0-2]
- Backport patches for various CVEs
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-194176 RHEL-194179 RHEL-208658

[1:24.18.0-1]
- Update to version 24.18.0
Resolves: RHEL-168744

[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1
Related: RHEL-151374

[1:24.14.1-1]
- Update to 24.14.0
Resolves: RHEL-151374

[1:24.13.0-1]
- Update to 24.13.0
Resolves: RHEL-135257

[1:24.4.1-1]
- Initial import of nodejs:24

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Switch from using remys fork as a source to npm.
- Resolves: RHEL-208657

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121576

[2021.06-5]
- nodejs.req to properly detect bundled deps

[2021.06-4]
- NPM bundler: also find namespaced bundled dependencies

[2021.06-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

[2021.06-2]
- Fix hard-coded output directory in the bundler

[2021.06-1]
- Update to 2021.06-1
- bundler: Handle archaic license metadata
- bundler: Warn about bundled dependencies with no license metadata

[2021.01-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[2021.01-2]
- nodejs-packaging-bundler improvements to handle uncommon characters

[2021.01]
- Add nodejs-packaging-bundler and update README.md

[2020.09-1]
- Move to dist-git as the upstream

Related CVEs

CVE-2026-13149

CVE-2026-59873

CVE-2026-59874

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	nodejs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.src.rpm	552811ee05535b8a90053ea3096cd78430ae423c4d4029f7f16d7cc23a62557c	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90975+7cc1ae68.src.rpm	099ff35cdb77733b8645144bd6b974ffac45eb627c72e0bf5101878a937358d1	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el8.10.0+90975+7cc1ae68.src.rpm	1027b0bceddad2dd56f245f945a809d7ff21c05948a69d125840068fb02d099b	-	ol8_aarch64_appstream
	nodejs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.aarch64.rpm	975d8c294cf37f03a28aec1a31157464a122206b2e7ccc6ea347e6305962cd64	-	ol8_aarch64_appstream
	nodejs-devel-24.18.0-2.module+el8.10.0+90975+7cc1ae68.aarch64.rpm	5644dcdeaf1739efac6904e2c36e5ade47e4ae5b8741c6d078bf8255ffa27877	-	ol8_aarch64_appstream
	nodejs-docs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.noarch.rpm	cf542f7d40e15b1ae4ef7024d0ae2fc24bcabc1b8d47951a9cce12bb5bb0f1a0	-	ol8_aarch64_appstream
	nodejs-full-i18n-24.18.0-2.module+el8.10.0+90975+7cc1ae68.aarch64.rpm	5dc438c81cbccd672b6588c38c5ac4d9c34acfe01dcd8fac06dbb0df570de9e3	-	ol8_aarch64_appstream
	nodejs-libs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.aarch64.rpm	f0a848e8543407daec06deccb23f4f8d8affae8a478be5f4d56c181620a0c011	-	ol8_aarch64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90975+7cc1ae68.noarch.rpm	ad3bdaaff98515c480e470dda00d25cf56a628773efae76c40fe194b2b5565d4	-	ol8_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el8.10.0+90975+7cc1ae68.noarch.rpm	57f5f6c37956734df93202f9466b4506853db6d181c0dd59f3c5dda538769e60	-	ol8_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el8.10.0+90975+7cc1ae68.noarch.rpm	69348986c33f1eeeb805c10830a99ca6bc78498dfcb988c48645dd96d4fd0608	-	ol8_aarch64_appstream
	npm-11.16.0-1.24.18.0.2.module+el8.10.0+90975+7cc1ae68.noarch.rpm	2b5fb9b59e841bbf72f2f6704a5b48a1fcc829727f8960ec6aac7f352998f3c1	-	ol8_aarch64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.2.module+el8.10.0+90975+7cc1ae68.aarch64.rpm	5d403ef7fe012c461338267b7ae7e91f58b1a06ebfbb43d42dae429c3198af71	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	nodejs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.src.rpm	552811ee05535b8a90053ea3096cd78430ae423c4d4029f7f16d7cc23a62557c	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90975+7cc1ae68.src.rpm	099ff35cdb77733b8645144bd6b974ffac45eb627c72e0bf5101878a937358d1	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el8.10.0+90975+7cc1ae68.src.rpm	1027b0bceddad2dd56f245f945a809d7ff21c05948a69d125840068fb02d099b	-	ol8_x86_64_appstream
	nodejs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.x86_64.rpm	2a5336831b09c87c01ddd7190be3be6b72f5e61d54d8ca8d51f428496a347e5b	-	ol8_x86_64_appstream
	nodejs-devel-24.18.0-2.module+el8.10.0+90975+7cc1ae68.x86_64.rpm	7f9b1e329e6cb0f58bfcce3285cd69f961855c049c7f6f48f29d340cea716cc6	-	ol8_x86_64_appstream
	nodejs-docs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.noarch.rpm	cf542f7d40e15b1ae4ef7024d0ae2fc24bcabc1b8d47951a9cce12bb5bb0f1a0	-	ol8_x86_64_appstream
	nodejs-full-i18n-24.18.0-2.module+el8.10.0+90975+7cc1ae68.x86_64.rpm	e10f601ffaa3f664dc9237114b549c9053b429e3f7bddb6f64bfdc25594e7e3b	-	ol8_x86_64_appstream
	nodejs-libs-24.18.0-2.module+el8.10.0+90975+7cc1ae68.x86_64.rpm	c2988f7174f7bd1fa4dd2752ac36921107436f4910c394192aec85c8d09282e4	-	ol8_x86_64_appstream
	nodejs-nodemon-3.1.14-1.module+el8.10.0+90975+7cc1ae68.noarch.rpm	ad3bdaaff98515c480e470dda00d25cf56a628773efae76c40fe194b2b5565d4	-	ol8_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el8.10.0+90975+7cc1ae68.noarch.rpm	57f5f6c37956734df93202f9466b4506853db6d181c0dd59f3c5dda538769e60	-	ol8_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el8.10.0+90975+7cc1ae68.noarch.rpm	69348986c33f1eeeb805c10830a99ca6bc78498dfcb988c48645dd96d4fd0608	-	ol8_x86_64_appstream
	npm-11.16.0-1.24.18.0.2.module+el8.10.0+90975+7cc1ae68.noarch.rpm	2b5fb9b59e841bbf72f2f6704a5b48a1fcc829727f8960ec6aac7f352998f3c1	-	ol8_x86_64_appstream
	v8-13.6-devel-13.6.233.17-1.24.18.0.2.module+el8.10.0+90975+7cc1ae68.x86_64.rpm	ffa3d81db61ea3fd4e7db07a28382f3477dc148d2cc134035b0e79bc0581e8d0	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team