Skip to content
OpenAdvisories
High ELSA-2026-75864 2 CVEs

Important: nodejs22 security update (Oracle Linux 10)

Published Oct 6, 2026 · Updated Oct 6, 2026

Ecosystem: Oracle Linux

Summary

[1:22.23.1-4.0.1]
- Add c-ares as dependency [orabug 39781219]

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 10 nodejs 1:22.23.2-3.0.1.el10_2
Oracle Linux · 10 nodejs-devel 1:22.23.2-3.0.1.el10_2
Oracle Linux · 10 nodejs-docs 1:22.23.2-3.0.1.el10_2
Oracle Linux · 10 nodejs-full-i18n 1:22.23.2-3.0.1.el10_2
Oracle Linux · 10 nodejs-libs 1:22.23.2-3.0.1.el10_2
Oracle Linux · 10 nodejs-npm 1:10.9.8-1.22.23.2.3.0.1.el10_2

Vulnerabilities 2

  • High 7.5
    CVE-2026-19534

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-9496

    pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

    Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…

    prism lerna npm npm Debian Ubuntu Wolfi npm