[ALSA-2026:47059] Important: nodejs:22 security update
Type:
security
Severity:
important
Release date:
2026-07-29
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-devel-22.23.1-2.module_el8.10.0+4236+04bc75d9.aarch64.rpm 71073bd5df8018eaa6e28448187482242b5e244ca5564396f16c4411970b7df2
aarch64 v8-12.4-devel-12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.aarch64.rpm 75a6eb322756178cee64d6bdc654af1f4f50bc2926c3d8085f6150a98e5f0b8a
aarch64 npm-10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.aarch64.rpm a9aa856efbd41ea7b35a0dcdcda6cf050ef46afb79ac83a154803e40da11da7a
aarch64 nodejs-22.23.1-2.module_el8.10.0+4236+04bc75d9.aarch64.rpm bbc193495e18fb51d58b75d487b0e8ca6a6bf8efd417eea7fb489c070c71b104
aarch64 nodejs-libs-22.23.1-2.module_el8.10.0+4236+04bc75d9.aarch64.rpm cd9513217e08d19fcd15e866060558a53e795aba8a73915e78341abe21315a63
aarch64 nodejs-full-i18n-22.23.1-2.module_el8.10.0+4236+04bc75d9.aarch64.rpm d3029535e6cf998fd0b20a5d12ac72f7648c7dfa7c09589d67755299530f5a33
noarch nodejs-nodemon-3.1.14-1.module_el8.10.0+4236+04bc75d9.noarch.rpm 4da732a11328354a67032f0a5958818cd375af55474cc1e0f2765f1a71968c8d
noarch nodejs-docs-22.23.1-2.module_el8.10.0+4236+04bc75d9.noarch.rpm 78c00b051fa82066c032b6013f822c2c4e29e44d88235938e82ad6f397a04173
noarch nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4158+e796f37f.noarch.rpm 95549e780e9ad76b8e49f9c9db940d99cb8260f37e3d9cf05df2baaf6182e412
noarch nodejs-packaging-2021.06-6.module_el8.10.0+4158+e796f37f.noarch.rpm aaede6e40164690ca8a8b2229ad4ad4e0faea8ce4f2d6cfb3358572d8576dace
ppc64le nodejs-full-i18n-22.23.1-2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm 0332ae943be43d23f382ef8926639c24c1aafd92b5e800429bdc5be492d831b8
ppc64le nodejs-devel-22.23.1-2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm c8cfe4903010d78fa3ea288754f8b3c9e763151214098b5bc401c6c9747e5d8e
ppc64le v8-12.4-devel-12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm eba4d11b01efe72f1437c26744e61028685c64afba2e96f223e86187008d1162
ppc64le nodejs-libs-22.23.1-2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm f706491abf2e74651935682496885146aad4f12f1d74d2a300ff63343558ed46
ppc64le npm-10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm f96cc0469406dc92aeab64dab63b2c9db939d73a7b74dddc6355f235f4c995c3
ppc64le nodejs-22.23.1-2.module_el8.10.0+4236+04bc75d9.ppc64le.rpm faccc59bc3f538aacc8c5bbb3d839768f3cd56a12d1490cbe2a25ab1ed9d83eb
s390x nodejs-22.23.1-2.module_el8.10.0+4236+04bc75d9.s390x.rpm 118cbdc517e6004d264755b3e3d157b4af62bd5ebf225c23d2f97205d6fefc35
s390x nodejs-devel-22.23.1-2.module_el8.10.0+4236+04bc75d9.s390x.rpm 519066d9b906847bc4f0f508445e3e93b768e76603a52e5172f84a62e3c9f525
s390x npm-10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.s390x.rpm 7cda00cb7906475ed687c98fa6a59d03e83f2a5cb4766334f3e1853a3c6ec58a
s390x nodejs-libs-22.23.1-2.module_el8.10.0+4236+04bc75d9.s390x.rpm ca431e574b8f4ff3f8fe2815105f9d84931ff97946f9091d04e7c2e1576c0dc2
s390x v8-12.4-devel-12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.s390x.rpm cc5f09b2f0cd4b6bbec45517629684f0644fc72f10c7e18996d8c5cd7615eccf
s390x nodejs-full-i18n-22.23.1-2.module_el8.10.0+4236+04bc75d9.s390x.rpm ee7247a8b1c5fbbb43cec0fc4675e5a725a0ea8c940090e650b504bcd01b917a
x86_64 nodejs-devel-22.23.1-2.module_el8.10.0+4236+04bc75d9.x86_64.rpm 430e3cada100f8132109b5d52b71ae1aecc873667098ce1ebf33e7f514cc02ea
x86_64 nodejs-full-i18n-22.23.1-2.module_el8.10.0+4236+04bc75d9.x86_64.rpm a5ca63c57f8752da1780e508b8df6c4a55e02e570830a020605652c5f267fc1c
x86_64 nodejs-22.23.1-2.module_el8.10.0+4236+04bc75d9.x86_64.rpm cc928e176b1405e1f066eaade938fbd7d45f10e193afda16ab40d622889ca5f4
x86_64 v8-12.4-devel-12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.x86_64.rpm e449444771501ca803e094fb717a909281a83adcb2f71c79cb1b625d83c5eac5
x86_64 nodejs-libs-22.23.1-2.module_el8.10.0+4236+04bc75d9.x86_64.rpm f7a4a5250d4bfef7f66762489f010e6781f97820071c69be2a920b990414ed02
x86_64 npm-10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9.x86_64.rpm fac732951ecda2a5313c62768d4c7145e493378d26e79842471cbb6c08b571fe
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.