Stay Connected:

ELSA-2026-74085

ELSA-2026-74085 - nodejs:24 security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-02

Description


nodejs
[1:24.21.0-1]
- Update to version 24.21.0
Fix: CVE-2026-85152 CVE-2026-84961 CVE-2026-19534
Resolves: RHEL-255252 RHEL-255291 RHEL-255313 RHEL-249188

[1:24.18.0-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 5.9.0
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
Resolves: RHEL-223388 RHEL-223907 RHEL-223792

[1:24.18.0-3]
- Backport patch update sqlite to 3.53.4
Fixes: CVE-2026-11824, CVE-2026-11822
Resolves: RHEL-218252 RHEL-218257

[1:24.18.0-2]
- Backport patches for various CVEs
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-194176 RHEL-194179 RHEL-208658

[1:24.18.0-1]
- Update to version 24.18.0
Resolves: RHEL-168744

[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1
Related: RHEL-151374

[1:24.14.1-1]
- Update to 24.14.0
Resolves: RHEL-151374

[1:24.13.0-1]
- Update to 24.13.0
Resolves: RHEL-135257

[1:24.4.1-1]
- Initial import of nodejs:24

nodejs-nodemon
[3.1.14-2]
- Rebase npm/brace-expansion to 5.0.9
Fixes: CVE-2026-69152
Resolves: RHEL-223789

[3.1.14-1]
- Rebase to 3.1.14
- Switch from using remys fork as a source to npm.
- Resolves: RHEL-208657

[3.0.3-1]
- Initial import into nodejs:24 module

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121576

[2021.06-5]
- nodejs.req to properly detect bundled deps

[2021.06-4]
- NPM bundler: also find namespaced bundled dependencies

[2021.06-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

[2021.06-2]
- Fix hard-coded output directory in the bundler

[2021.06-1]
- Update to 2021.06-1
- bundler: Handle archaic license metadata
- bundler: Warn about bundled dependencies with no license metadata

[2021.01-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[2021.01-2]
- nodejs-packaging-bundler improvements to handle uncommon characters

[2021.01]
- Add nodejs-packaging-bundler and update README.md

[2020.09-1]
- Move to dist-git as the upstream


Related CVEs


CVE-2026-19534
CVE-2026-84961
CVE-2026-85152

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 8 (aarch64) nodejs-24.21.0-1.module+el8.10.0+91054+4b1a799c.src.rpm4ddf7dd7300fa5b1b5a79aedbce3a092d1f64a5977b5fe69d6978d09e9f57aa0-ol8_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.src.rpmdaa5d1b67a29be89e70835176530a3a9314865b6dbb0b89770d8b8684b57aa99-ol8_aarch64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.src.rpma4bb78627f5ef5c6debbfbd52af5de22c6764ffc6702f83471a62046d74ead9c-ol8_aarch64_appstream
nodejs-24.21.0-1.module+el8.10.0+91054+4b1a799c.aarch64.rpm8bafc889f59d0b814819e455794dfc181ce07aeb87eddf200fd8e7e474635b49-ol8_aarch64_appstream
nodejs-devel-24.21.0-1.module+el8.10.0+91054+4b1a799c.aarch64.rpme21635d1f274d0ca62f64513c843e3211013440445ae2f570de9bafc03870623-ol8_aarch64_appstream
nodejs-docs-24.21.0-1.module+el8.10.0+91054+4b1a799c.noarch.rpmca335922e12a0c4553887ea8b1f073220768b30c6b70f10671f7045639786f16-ol8_aarch64_appstream
nodejs-full-i18n-24.21.0-1.module+el8.10.0+91054+4b1a799c.aarch64.rpm77816d2344bc2f656e36370729d8259e528cae5c9e14d6450e142032b980373c-ol8_aarch64_appstream
nodejs-libs-24.21.0-1.module+el8.10.0+91054+4b1a799c.aarch64.rpmfc3748f114779e53448ca371a7a1e8ef107aa0d8dee8a5e84322b04cff96aca9-ol8_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm0d3b514a623650b3bcd425cc67f2bccdb0d9a406c0c059fe8ba6c6925f814d38-ol8_aarch64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpmcabda19951a14e9c9cb61547c90679fa32aa9d99ed5314ee49157f7c8e17f3eb-ol8_aarch64_appstream
nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm528a16b844cadf1954951c61c4928303cd51778c04063a01df3ac82fe04b54bd-ol8_aarch64_appstream
npm-11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c.noarch.rpmd89b3163f457d180841bde0a3863beedc0273b6bcf4e73481214ef6451c3901f-ol8_aarch64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c.aarch64.rpm720fe3946d71ccc034b3b0cd455cc8cb9c6ef440d7b53baadb7b776eb48b742e-ol8_aarch64_appstream
Oracle Linux 8 (x86_64) nodejs-24.21.0-1.module+el8.10.0+91054+4b1a799c.src.rpm4ddf7dd7300fa5b1b5a79aedbce3a092d1f64a5977b5fe69d6978d09e9f57aa0-ol8_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.src.rpmdaa5d1b67a29be89e70835176530a3a9314865b6dbb0b89770d8b8684b57aa99-ol8_x86_64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.src.rpma4bb78627f5ef5c6debbfbd52af5de22c6764ffc6702f83471a62046d74ead9c-ol8_x86_64_appstream
nodejs-24.21.0-1.module+el8.10.0+91054+4b1a799c.x86_64.rpm12a74e4dea7e733ad016d06d42963f87a91f7dc0fb7c012c289fc99c55fc4d23-ol8_x86_64_appstream
nodejs-devel-24.21.0-1.module+el8.10.0+91054+4b1a799c.x86_64.rpm2d0545da1390383b586fe27e9be7ded687bc2d02bb3f951871612380b12686bc-ol8_x86_64_appstream
nodejs-docs-24.21.0-1.module+el8.10.0+91054+4b1a799c.noarch.rpmca335922e12a0c4553887ea8b1f073220768b30c6b70f10671f7045639786f16-ol8_x86_64_appstream
nodejs-full-i18n-24.21.0-1.module+el8.10.0+91054+4b1a799c.x86_64.rpm5aa84a926b3c30ebb6f24873360483ce490b9693fe1aac0db8db9f38c6142990-ol8_x86_64_appstream
nodejs-libs-24.21.0-1.module+el8.10.0+91054+4b1a799c.x86_64.rpmee91623158b3557b7566e2b0b84cb5f18552252b255b9668074aacc8cc8b1706-ol8_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm0d3b514a623650b3bcd425cc67f2bccdb0d9a406c0c059fe8ba6c6925f814d38-ol8_x86_64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpmcabda19951a14e9c9cb61547c90679fa32aa9d99ed5314ee49157f7c8e17f3eb-ol8_x86_64_appstream
nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm528a16b844cadf1954951c61c4928303cd51778c04063a01df3ac82fe04b54bd-ol8_x86_64_appstream
npm-11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c.noarch.rpmd89b3163f457d180841bde0a3863beedc0273b6bcf4e73481214ef6451c3901f-ol8_x86_64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c.x86_64.rpm21b0854addf04b46417dd2fc88b1deab01a4df68c76ea4b4b6bdf8e87d215aef-ol8_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights