ELSA-2026-92376

ELSA-2026-92376 - nodejs:24 security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-30

Description


nodejs
[1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

nodejs-nodemon
nodejs-packaging


Related CVEs


CVE-2026-101911
CVE-2026-102276
CVE-2026-102277
CVE-2026-102278
CVE-2026-105481
CVE-2026-105482
CVE-2026-105483
CVE-2026-106069
CVE-2026-106071
CVE-2026-106072
CVE-2026-106073
CVE-2026-106074
CVE-2026-111497

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 8 (aarch64) nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.src.rpmbb746e68d4a51691841633442de539361fabd92e915a27ce721e5899ebf9b740-ol8_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.src.rpmdaa5d1b67a29be89e70835176530a3a9314865b6dbb0b89770d8b8684b57aa99-ol8_aarch64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.src.rpma4bb78627f5ef5c6debbfbd52af5de22c6764ffc6702f83471a62046d74ead9c-ol8_aarch64_appstream
nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm7e3a27278ea320f21ed456ef555a0c2a6083749bc46e02a66d75c8962fc85764-ol8_aarch64_appstream
nodejs-devel-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpmb8a91499440adccb2939e158e719af8fea5696d7ac95c42544135c2f6663413e-ol8_aarch64_appstream
nodejs-docs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm625f6e4a5eada780817a9044d7cd83e95054c057f55bc54a36a15867646612f7-ol8_aarch64_appstream
nodejs-full-i18n-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpme232f87292911de416cfba2cc4305378b6fc19dbd1f2995d31351b79906b05c9-ol8_aarch64_appstream
nodejs-libs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm36fa8179393f8f5b8e865cf28158e8b16a5a14dece1a615306c87e72b7935060-ol8_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm0d3b514a623650b3bcd425cc67f2bccdb0d9a406c0c059fe8ba6c6925f814d38-ol8_aarch64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpmcabda19951a14e9c9cb61547c90679fa32aa9d99ed5314ee49157f7c8e17f3eb-ol8_aarch64_appstream
nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm528a16b844cadf1954951c61c4928303cd51778c04063a01df3ac82fe04b54bd-ol8_aarch64_appstream
npm-11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm0f73845ae12c17a2ba6fbc27290a0349743e5c39acb284476108ce0de6626bd0-ol8_aarch64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpmb57236b3e2ad8315219d1a45c4e800faf2516cfbbb71d5e01d70aa7042a2fd22-ol8_aarch64_appstream
Oracle Linux 8 (x86_64) nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.src.rpmbb746e68d4a51691841633442de539361fabd92e915a27ce721e5899ebf9b740-ol8_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.src.rpmdaa5d1b67a29be89e70835176530a3a9314865b6dbb0b89770d8b8684b57aa99-ol8_x86_64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.src.rpma4bb78627f5ef5c6debbfbd52af5de22c6764ffc6702f83471a62046d74ead9c-ol8_x86_64_appstream
nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm2aad0e1722c8fab517d3667d91704b326bddc8204b0743ab751846cb1e720078-ol8_x86_64_appstream
nodejs-devel-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm235d68da886739e46e0850cc96d2ca1643b335d099ba5506a098b6dc32787fbc-ol8_x86_64_appstream
nodejs-docs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm625f6e4a5eada780817a9044d7cd83e95054c057f55bc54a36a15867646612f7-ol8_x86_64_appstream
nodejs-full-i18n-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm48ace0b955fe8be388026b3df074008201b682b2a449fd1962c49373a50bd570-ol8_x86_64_appstream
nodejs-libs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm6a8b3d40ecce09f67661ac3265f239d8bf65ef9a4e4c5c32f870341ffc1b0329-ol8_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm0d3b514a623650b3bcd425cc67f2bccdb0d9a406c0c059fe8ba6c6925f814d38-ol8_x86_64_appstream
nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpmcabda19951a14e9c9cb61547c90679fa32aa9d99ed5314ee49157f7c8e17f3eb-ol8_x86_64_appstream
nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm528a16b844cadf1954951c61c4928303cd51778c04063a01df3ac82fe04b54bd-ol8_x86_64_appstream
npm-11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm0f73845ae12c17a2ba6fbc27290a0349743e5c39acb284476108ce0de6626bd0-ol8_x86_64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpmae890383cb734f0196462b92bce538734ee8ffb3939a918cf6f245d997fb1974-ol8_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete