Skip to content
OpenAdvisories
High ELSA-2026-96234 7 CVEs

Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9)

Published Nov 11, 2026 · Updated Nov 11, 2026

Ecosystem: Oracle Linux

Summary

nodejs
[1:22.23.2-2.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds

[1:22.23.2-2]
- Patches Pacote CVE and update undici to 6.28.1
Fixes: CVE-2026-9496 CVE-2026-19534
Resolves: RHEL-259889 RHEL-255272

[1:22.23.2-1]
- Update to version 22.23.2
Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043
Resolves: RHEL-234381 RHEL-234831 RHEL-234896

[1:22.23.1-3]
- deps: update npm/ip-address to 10.4.0
- deps: update npm/brace-expansion to 2.1.4
Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
Resolves: RHEL-223914 RHEL-223798

[1:22.23.1-3]
- deps: update sqlite to 3.53.4
Fix: CVE-2026-11824, CVE-2026-11822

[1:22.23.1-2]
- Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
- Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149
Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680

[1:22.23.1-1]
- Update to version 22.23.1
Resolves: RHEL-186622 RHEL-185998 RHEL-183669
Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

[1:22.22.2-1]
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
Resolves: RHEL-163370
Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547

[1:22.22.0-1]
- Update to 22.22.0
Resolves: RHEL-118153

[1.22.19.0-1]
- Update to 22.19.0
Resolves: RHEL-111913

nodejs-nodemon
[3.1.14-1]
- Rebase to 3.1.14
- Change
%setup -q

/usr/bin/cat /builddir/build/SOURCES/0001-deps-glob-parent-Resolve-ReDoS-vulnerability-from-CV.patch |
/usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch

- Resolves: RHEL-208677

nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-120511

[2021.06-5]
- nodejs.req to properly detect bundled deps

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 9 nodejs 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-devel 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-docs 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-full-i18n 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-libs 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-nodemon 0:3.1.14-2.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.8.0+91010+e0f4f255
Oracle Linux · 9 nodejs-packaging-bundler 0:2021.06-6.module+el9.8.0+91010+e0f4f255
Oracle Linux · 9 npm 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61
Oracle Linux · 9 v8-12.4-devel 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61

Vulnerabilities 7

  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-106069 Public exploit

    A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm