Skip to content
OpenAdvisories
High 1 exploited CVE ELSA-2026-500517 1 CVE

Important: nodejs:22 security update (Oracle Linux 9)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Oracle Linux

Summary

nodejs
[1:22.23.2-2.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

nodejs-nodemon
nodejs-packaging

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 9 nodejs 1:22.23.2-2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 nodejs-devel 1:22.23.2-2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 nodejs-docs 1:22.23.2-2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 nodejs-full-i18n 1:22.23.2-2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 nodejs-libs 1:22.23.2-2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 nodejs-nodemon 0:3.1.14-2.module+el9.8.0+91010+e0f4f255
Oracle Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.8.0+91010+e0f4f255
Oracle Linux · 9 nodejs-packaging-bundler 0:2021.06-6.module+el9.8.0+91010+e0f4f255
Oracle Linux · 9 npm 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91084+6a4a26be
Oracle Linux · 9 v8-12.4-devel 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91084+6a4a26be

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026