Stay Connected:

ELSA-2026-96234

ELSA-2026-96234 - nodejs:22 security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-11-11

Description


nodejs
[1:22.23.2-2.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

[1:22.23.2-2]
- Patches Pacote CVE and update undici to 6.28.1
Fixes: CVE-2026-9496 CVE-2026-19534
Resolves: RHEL-259889 RHEL-255272

[1:22.23.2-1]
- Update to version 22.23.2
Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043
Resolves: RHEL-234381 RHEL-234831 RHEL-234896

[1:22.23.1-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 2.1.4
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
Resolves: RHEL-223914 RHEL-223798

[1:22.23.1-3]
- deps: update sqlite to 3.53.4
Fix: CVE-2026-11824, CVE-2026-11822

[1:22.23.1-2]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-186622 RHEL-185998 RHEL-183669
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
Resolves: RHEL-163370
Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118153

[1.22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-111913

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Change
%setup -q




/usr/bin/cat /builddir/build/SOURCES/0001-deps-glob-parent-Resolve-ReDoS-vulnerability-from-CV.patch |
/usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch


- Resolves: RHEL-208677

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-120511

[2021.06-5]
- nodejs.req to properly detect bundled deps


Related CVEs


CVE-2026-102276
CVE-2026-102278
CVE-2026-105482
CVE-2026-106069
CVE-2026-109383
CVE-2026-109869
CVE-2026-87018

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 9 (aarch64) nodejs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.src.rpm04e4cc29c4769bedf26d77ae79e1a308f37418a7cf708cdde7e2c1cf3c35dd40-ol9_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el9.8.0+91110+558b6b61.src.rpm642fe41c72a6dfa5dda1796e330e7e0e86427bd005920baba0ba90cfaa80a2f1-ol9_aarch64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.src.rpm6d341ed26e1268fbf465ce25d3b1f1d4eb4d12830958f909af2ce649030d76f6-ol9_aarch64_appstream
nodejs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm256c9ae4627cbc2ca173d1aba8fa29e7a89054caf2c57a0e8e45a860be67fd7e-ol9_aarch64_appstream
nodejs-devel-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm6bc31c38cef6c29ad4642800e90a24ca631f9ae040738d68446b06aec26dd48b-ol9_aarch64_appstream
nodejs-docs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.noarch.rpmc30a818d04b59260dd950c1d74f6ad70655204f7721094003094e0ab6e4e21a6-ol9_aarch64_appstream
nodejs-full-i18n-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm9317786464e044046434978006807141b5d179a265c1aeed7b9bc201d98c72fe-ol9_aarch64_appstream
nodejs-libs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm4b7e54814790cb361735185d94aa1cdf192cf7197c3639ad7c6916f78cff42cf-ol9_aarch64_appstream
nodejs-nodemon-3.1.14-2.module+el9.8.0+91110+558b6b61.noarch.rpm962fe6372b7cc64d5228b341cd8bfeef0b27512e49b6ef9c22f03bed8417fdeb-ol9_aarch64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm99f5d90350bc1ba909c679601562085a52fb0ff3f05fef90c2d210efbb7829e0-ol9_aarch64_appstream
nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpmd50e4f118178582c30d8143a94c1feee61b963e55783188e51ef038a60d8e0f0-ol9_aarch64_appstream
npm-10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm5217c949b27218eae94cc8b01e086eb98c189320991ad7c328a27246ce61ea70-ol9_aarch64_appstream
v8-12.4-devel-12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61.aarch64.rpm20ab0dbebe7ae92d5fc04bc93eb8f94bd5be8384fb777e3019b42d11a7ba3fa8-ol9_aarch64_appstream
Oracle Linux 9 (x86_64) nodejs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.src.rpm04e4cc29c4769bedf26d77ae79e1a308f37418a7cf708cdde7e2c1cf3c35dd40-ol9_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el9.8.0+91110+558b6b61.src.rpm642fe41c72a6dfa5dda1796e330e7e0e86427bd005920baba0ba90cfaa80a2f1-ol9_x86_64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.src.rpm6d341ed26e1268fbf465ce25d3b1f1d4eb4d12830958f909af2ce649030d76f6-ol9_x86_64_appstream
nodejs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpma0f5280bb03f319a2385388f012138fab705b6b2fa80194295c3530091725da4-ol9_x86_64_appstream
nodejs-devel-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpma4839698fc4e53950e8e0aac946a17745ba944b30fbbb05c1ce164f88a7abbff-ol9_x86_64_appstream
nodejs-docs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.noarch.rpmc30a818d04b59260dd950c1d74f6ad70655204f7721094003094e0ab6e4e21a6-ol9_x86_64_appstream
nodejs-full-i18n-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpmcd321dc2edfe5fb1f0456e27abf2994774737b27a67ee67a3c89305e79091687-ol9_x86_64_appstream
nodejs-libs-22.23.2-2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpm1cfa2841433494d820e6247ff63dcf9cd6124a34e2735a9dbdb31bb8313c8146-ol9_x86_64_appstream
nodejs-nodemon-3.1.14-2.module+el9.8.0+91110+558b6b61.noarch.rpm962fe6372b7cc64d5228b341cd8bfeef0b27512e49b6ef9c22f03bed8417fdeb-ol9_x86_64_appstream
nodejs-packaging-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpm99f5d90350bc1ba909c679601562085a52fb0ff3f05fef90c2d210efbb7829e0-ol9_x86_64_appstream
nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91010+e0f4f255.noarch.rpmd50e4f118178582c30d8143a94c1feee61b963e55783188e51ef038a60d8e0f0-ol9_x86_64_appstream
npm-10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpm3900bfa9bfd0719671c37187da2e9ea63648edbe99b232126eb4b9f59f3e49ed-ol9_x86_64_appstream
v8-12.4-devel-12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61.x86_64.rpmd4012691fbd169fde87928baa0d0ea81b0237de69e94337d7da99c9f0c3321ae-ol9_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights