ELSA-2026-92378

ELSA-2026-92378 - nodejs:24 security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-30

Description


nodejs
[1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

nodejs-nodemon
nodejs-packaging


Related CVEs


CVE-2026-101911
CVE-2026-102276
CVE-2026-102277
CVE-2026-102278
CVE-2026-105481
CVE-2026-105482
CVE-2026-105483
CVE-2026-106069
CVE-2026-106071
CVE-2026-106072
CVE-2026-106073
CVE-2026-106074
CVE-2026-111497

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 9 (aarch64) nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.src.rpm5da6f22f5d0d7960205ce6a3619706814e0ba871b4cd5b01b7e00dfa8d6e47d9-ol9_aarch64_appstream
nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.src.rpm9d81ac709b44544603a147810b38915d474a8d58172914373e7a9f23318bd37d-ol9_aarch64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.src.rpm834d57d7c4bdd82742c432c76fd87305eb15db00f697778fc30d5c7f23591feb-ol9_aarch64_appstream
nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpmf24dd07946bfdfcfc2753ea458d6ecd91da28fe09b6303d5443bbc352ed8cb47-ol9_aarch64_appstream
nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm75093f155dfa4b65bb6f26acad6277e74daef9e96bb7195ef59d939d753ef2b6-ol9_aarch64_appstream
nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpmd721e9cd3a0322c98e45db1acac3e195bf2bdec87d68925079abbcdd1dc221ac-ol9_aarch64_appstream
nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm9ea5b7a783cab1836e3678bed8e61228a020a0b1b71fbc32eb424e15921be332-ol9_aarch64_appstream
nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm3f856307aed7a3e37b314a1befbf7e459cf33138fee766c425199c3b6b48036c-ol9_aarch64_appstream
nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.noarch.rpm294df3aab894e69a3db8025359d13da96df7ed29e033d35d8c63adb7e94a810f-ol9_aarch64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm5eb6a5f146d9a1b82c91a7b419c088c7a16cea176a93e854dd49e76ee8898d09-ol9_aarch64_appstream
nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm04cc6849d05fc7de46803cb556ae2f3184824991ba82f49fdaf5b082b78f441a-ol9_aarch64_appstream
npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm71376634032c723e073b2a49c239e14aa4518c04dfb481303645202bd26c42ba-ol9_aarch64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpmfd24698b15092d3f721d12b0e74d33784cc55241c3a8b23dca30219636e31eb0-ol9_aarch64_appstream
Oracle Linux 9 (x86_64) nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.src.rpm5da6f22f5d0d7960205ce6a3619706814e0ba871b4cd5b01b7e00dfa8d6e47d9-ol9_x86_64_appstream
nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.src.rpm9d81ac709b44544603a147810b38915d474a8d58172914373e7a9f23318bd37d-ol9_x86_64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.src.rpm834d57d7c4bdd82742c432c76fd87305eb15db00f697778fc30d5c7f23591feb-ol9_x86_64_appstream
nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpmbc3c307d7014f2342755fedd088e204b75402349ebf797791059faaa4e0db296-ol9_x86_64_appstream
nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm0e0fe5cbe7ab11415f53a5c836f5c7275905c8a867747c161a8486805bb14b70-ol9_x86_64_appstream
nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpmd721e9cd3a0322c98e45db1acac3e195bf2bdec87d68925079abbcdd1dc221ac-ol9_x86_64_appstream
nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm83c9cd1be4fb78e7be32201cc2be8ade04baa9b5cfd0175d3c809a4a05f6d867-ol9_x86_64_appstream
nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm278a877be490950aa8f1160684bdcf92991e690ff738c69c8e9b90c4ac03bed8-ol9_x86_64_appstream
nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.noarch.rpm294df3aab894e69a3db8025359d13da96df7ed29e033d35d8c63adb7e94a810f-ol9_x86_64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm5eb6a5f146d9a1b82c91a7b419c088c7a16cea176a93e854dd49e76ee8898d09-ol9_x86_64_appstream
nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm04cc6849d05fc7de46803cb556ae2f3184824991ba82f49fdaf5b082b78f441a-ol9_x86_64_appstream
npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm71376634032c723e073b2a49c239e14aa4518c04dfb481303645202bd26c42ba-ol9_x86_64_appstream
v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm139be5debf0488003a26d00f2359eb92eb5b4c31a8dd6b63e755f73dcfa0230f-ol9_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete