Summary
nodejs
[1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds
[1:24.21.0-1]
- Update to version 24.21.0
[1:24.19.0-1]
- Update to version 24.19.0
[1:24.18.0-6]
- Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149
(memory exhaustion via deeply chained brace groups). as well as
CVE-2026-14257 (fixed in 5.0.8).
[1:24.18.0-5]
- Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
[1:24.18.0-4]
- deps: update sqlite to 3.53.4
[1:24.18.0-3]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
[1:24.18.0-2]
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
[1:24.18.0-1]
- Update to version 24.18.0
[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1
nodejs-nodemon
[3.1.14-6]
- CVE-2026-102278 nodejs-nodemon: brace-expansion: Denial of Service via
uncontrolled recursion in nested brace patterns
[3.1.14-5]
- CVE-2026-118764 nodejs-nodemon: minimatch: Denial of Service via crafted
glob pattern expansion
[3.1.14-4]
- CVE-2026-102276 nodejs-nodemon: brace-expansion: Denial of Service via
stack exhaustion from crafted brace patterns
[3.1.14-3]
- Fix CVE-2026-69152 - brace-expansion
[3.1.14-2]
- Correction to sources for 3.1.14.
[3.1.14-1]
- Update to version 3.1.14
[3.0.3-3]
- Keep BR on just npm
[3.0.3-2]
- Fix BR for nodejs-npm
nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121569
[2021.06-5]
- nodejs.req to properly detect bundled deps
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | nodejs | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-devel | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-docs | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-full-i18n | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-libs | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-nodemon | 0:3.1.14-6.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux · 9 | nodejs-packaging-bundler | 0:2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux · 9 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 |
| Oracle Linux · 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 |
Vulnerabilities 10
-
High 7.8
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…
-
High 7.8
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when d…
-
High 7.8
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changes…
-
High 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …
-
High 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…
-
High 7.5
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.5
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…
-
High 7.4
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…
-
Medium 6.9CVE-2026-118764 Public exploit
minimatch: potential denial of service via globparts amplification
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands atta…