ELSA-2026-96226

ELSA-2026-96226 - nodejs:24 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-11-09

Description

nodejs
[1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

[1:24.21.0-1]
- Update to version 24.21.0

[1:24.19.0-1]
- Update to version 24.19.0

[1:24.18.0-6]
- Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149
(memory exhaustion via deeply chained brace groups). as well as
CVE-2026-14257 (fixed in 5.0.8).

[1:24.18.0-5]
- Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address

[1:24.18.0-4]
- deps: update sqlite to 3.53.4

[1:24.18.0-3]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar

[1:24.18.0-2]
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion

[1:24.18.0-1]
- Update to version 24.18.0

[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1

nodejs-nodemon
[3.1.14-6]
- CVE-2026-102278 nodejs-nodemon: brace-expansion: Denial of Service via
uncontrolled recursion in nested brace patterns

[3.1.14-5]
- CVE-2026-118764 nodejs-nodemon: minimatch: Denial of Service via crafted
glob pattern expansion

[3.1.14-4]
- CVE-2026-102276 nodejs-nodemon: brace-expansion: Denial of Service via
stack exhaustion from crafted brace patterns

[3.1.14-3]
- Fix CVE-2026-69152 - brace-expansion

[3.1.14-2]
- Correction to sources for 3.1.14.

[3.1.14-1]
- Update to version 3.1.14

[3.0.3-3]
- Keep BR on just npm

[3.0.3-2]
- Fix BR for nodejs-npm

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121569

[2021.06-5]
- nodejs.req to properly detect bundled deps

Related CVEs

CVE-2026-102276

CVE-2026-102278

CVE-2026-109383

CVE-2026-109869

CVE-2026-118764

CVE-2026-119373

CVE-2026-119374

CVE-2026-119379

CVE-2026-19534

CVE-2026-87018

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nodejs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.src.rpm	ae9f16fbfc8103a96db5915b22cc023f2801ae512bc865b9c6ced81381a1366c	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-6.module+el9.8.0+91109+154e6434.src.rpm	97109f46892535d884e3a68e7601d36327416b33b7f64a41636fa6fb2cec8fe3	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.src.rpm	834d57d7c4bdd82742c432c76fd87305eb15db00f697778fc30d5c7f23591feb	-	ol9_aarch64_appstream
	nodejs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.aarch64.rpm	4471ace60e54480ff54ab11e8ff0e6bbe80ac152928751e6c47b87e3a3d9e04f	-	ol9_aarch64_appstream
	nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.aarch64.rpm	e3c29e4456cda23c252e78b71debdc3edb77817b9232278a76afbe25fb153d92	-	ol9_aarch64_appstream
	nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.noarch.rpm	63ea5fcc569e36b37c912b29407332058886ccc6846aee9024924a0046538e10	-	ol9_aarch64_appstream
	nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.aarch64.rpm	072437088bee3cc406830a9ed2d9a4f7e9e95042621b2b6dcc62d39b7e555265	-	ol9_aarch64_appstream
	nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.aarch64.rpm	bb8d8cd2fbe3276b90ecafe9b6943697223a7ab75ab4168248e65b434baf7d04	-	ol9_aarch64_appstream
	nodejs-nodemon-3.1.14-6.module+el9.8.0+91109+154e6434.noarch.rpm	41daf3cb5b6180fd2f49496da0974740ef2d46ba0029d0efd77131179a9d509d	-	ol9_aarch64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm	5eb6a5f146d9a1b82c91a7b419c088c7a16cea176a93e854dd49e76ee8898d09	-	ol9_aarch64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm	04cc6849d05fc7de46803cb556ae2f3184824991ba82f49fdaf5b082b78f441a	-	ol9_aarch64_appstream
	npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434.noarch.rpm	0da75728c994f409fb0bf56663edd80566258aa8e422d77c6633038a0d2dc5ca	-	ol9_aarch64_appstream
	v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434.aarch64.rpm	595f199adaaa6670226bb2c21331a96a85a7ecacb05a0b6a528031083d6819a6	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nodejs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.src.rpm	ae9f16fbfc8103a96db5915b22cc023f2801ae512bc865b9c6ced81381a1366c	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-6.module+el9.8.0+91109+154e6434.src.rpm	97109f46892535d884e3a68e7601d36327416b33b7f64a41636fa6fb2cec8fe3	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.src.rpm	834d57d7c4bdd82742c432c76fd87305eb15db00f697778fc30d5c7f23591feb	-	ol9_x86_64_appstream
	nodejs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.x86_64.rpm	2b00580c928ae75756ca59aa8e50a9bca33e0d894973de173b38841b8ac5a1d6	-	ol9_x86_64_appstream
	nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.x86_64.rpm	de96c2c462f42f09103a9d9f347721aa05d1eab557c3ca8bddc2e4f07962c2f9	-	ol9_x86_64_appstream
	nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.noarch.rpm	63ea5fcc569e36b37c912b29407332058886ccc6846aee9024924a0046538e10	-	ol9_x86_64_appstream
	nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.x86_64.rpm	6cbca32dbfc21a1841541b1246b885b516ad30a3493fac9f3e9b68776bf51621	-	ol9_x86_64_appstream
	nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91109+154e6434.x86_64.rpm	2086ff5984a6ce30ce41996789780d1f03c44e6814d77c4138c36be5c8f99e5a	-	ol9_x86_64_appstream
	nodejs-nodemon-3.1.14-6.module+el9.8.0+91109+154e6434.noarch.rpm	41daf3cb5b6180fd2f49496da0974740ef2d46ba0029d0efd77131179a9d509d	-	ol9_x86_64_appstream
	nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm	5eb6a5f146d9a1b82c91a7b419c088c7a16cea176a93e854dd49e76ee8898d09	-	ol9_x86_64_appstream
	nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm	04cc6849d05fc7de46803cb556ae2f3184824991ba82f49fdaf5b082b78f441a	-	ol9_x86_64_appstream
	npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434.noarch.rpm	0da75728c994f409fb0bf56663edd80566258aa8e422d77c6633038a0d2dc5ca	-	ol9_x86_64_appstream
	v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434.x86_64.rpm	18fc39896ed9d58b3343d787bff4a8ff16995762e231d55632233041a440bb70	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team