Summary
nodejs
[1:22.23.2-2]
- Patches Pacote CVE and update undici to 6.28.1
Fixes: CVE-2026-9496 CVE-2026-19534
Resolves: RHEL-259889 RHEL-255272
[1:22.23.2-1]
- Update to version 22.23.2
Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043
Resolves: RHEL-234381 RHEL-234831 RHEL-234896
[1:22.23.1-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 2.1.4
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
Resolves: RHEL-223914 RHEL-223798
[1:22.23.1-3]
- deps: update sqlite to 3.53.4
Fix: CVE-2026-11824, CVE-2026-11822
[1:22.23.1-2]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680
[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-186622 RHEL-185998 RHEL-183669
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338
[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
Resolves: RHEL-163370
Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547
[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118153
[1.22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-111913
[1:22.16.0-2]
- Patch fix for CVE-2025-6965
Resolves: RHEL-103853
nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Change
%setup -q
/usr/bin/cat /builddir/build/SOURCES/0001-deps-glob-parent-Resolve-ReDoS-vulnerability-from-CV.patch |
/usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch
- Resolves: RHEL-208677
nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-120511
[2021.06-5]
- nodejs.req to properly detect bundled deps
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | nodejs | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | nodejs-devel | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | nodejs-docs | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | nodejs-full-i18n | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | nodejs-libs | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+91010+e0f4f255 |
| Oracle Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+91010+e0f4f255 |
| Oracle Linux · 9 | nodejs-packaging-bundler | 0:2021.06-6.module+el9.8.0+91010+e0f4f255 |
| Oracle Linux · 9 | npm | 1:10.9.8-1.22.23.2.2.module+el9.8.0+91062+a7d6b802 |
| Oracle Linux · 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el9.8.0+91062+a7d6b802 |
Vulnerabilities 2
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.5
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…