Summary
nodejs
[1:22.23.2-2]
- Patches pacote CVE and updates undici to 6.28.1
Fixes: CVE-2026-9496 CVE-2026-19534
Resolves: RHEL-259888 RHEL-255268
nodejs-nodemon
[3.1.14-2]
- Rebase npm/brace-expansion to 5.0.9
Fixes: CVE-2026-69152
Resolves: RHEL-223760
nodejs-packaging
[2021.06-4]
- Exclude ix86 arches from building.
Related: RHEL-35991
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-devel | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-docs | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-libs | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | npm | 1:10.9.8-1.22.23.2.2.module+el8.10.0+91061+02523cc0 |
| Oracle Linux · 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el8.10.0+91061+02523cc0 |
Vulnerabilities 2
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.5
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…