Nodejs:22 Security Update — AlmaLinux 9 (ALSA-2026:55601)
ALSA-2026:55601 ships corrected sqlite: packages for AlmaLinux 9: 5 CVEs are fixed, headlined by SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822). Update through the standard dnf path.
Что это значит по лицензии SharedLicense
sqlite: on AlmaLinux 9 is the exposure surface; the advisory's own severity data tops out at CVSS 5.5 (CWE-125).
Type:
security
Severity:
important
Release date:
2026-10-26
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
- CVE-2026-11822
- CVE-2026-11824
- CVE-2026-14257
- CVE-2026-69152
- CVE-2026-69192
- CVE-2026-54272
- RHSA-2026:55601
- ALSA-2026:55601
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | npm-10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce.aarch64.rpm | 1790e4633f01b02f7c90fc773083e0e1a207a15f412c1589517bcc38802b6d30 |
| aarch64 | nodejs-22.23.1-3.module_el9.8.0+291+0bb98cce.aarch64.rpm | 54e958daa5b557b0a19365ffe6ce29fd2c86a99adf290d8d2e41d30ec8e86f76 |
| aarch64 | nodejs-full-i18n-22.23.1-3.module_el9.8.0+291+0bb98cce.aarch64.rpm | 816192cb0eefa455fc90dc95ac3ef71831e91924d5105c06ac7f6c8765d16849 |
| aarch64 | nodejs-libs-22.23.1-3.module_el9.8.0+291+0bb98cce.aarch64.rpm | 885aa53da868b32706459d4524920313e4d184c521f7da9fa5e99979b8de6d7b |
| aarch64 | nodejs-devel-22.23.1-3.module_el9.8.0+291+0bb98cce.aarch64.rpm | acf0b985c5f82472de51891e3bc15efa9f7b3fb4a561facf7c77dd42b8ae3b05 |
| aarch64 | v8-12.4-devel-12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce.aarch64.rpm | b3d137d4ab104be746f888aacd9051292c72b2b40fd68c7824c8a012262988c3 |
| noarch | nodejs-nodemon-3.1.14-2.module_el9.8.0+291+0bb98cce.noarch.rpm | 36bfb4903244fdf5e11e5ef3cf579bd330a0b7dc8b53b9d7e7a3d490ff6c1e4c |
| noarch | nodejs-packaging-2021.06-6.module_el9.7.0+227+12323393.noarch.rpm | 69a2494a423d429b8f38a95646b0b58eac35f29de728da6f9b31d29d0a12c210 |
| noarch | nodejs-docs-22.23.1-3.module_el9.8.0+291+0bb98cce.noarch.rpm | 80351d45622e81ab7e34b6e82d9da149a69bd9d62175482b820f275532fd9695 |
| noarch | nodejs-packaging-bundler-2021.06-6.module_el9.7.0+227+12323393.noarch.rpm | ff48fa44ce4299dfc604486df6289fe1f7c720e5ffb57aa31f7e35342c057042 |
| ppc64le | nodejs-devel-22.23.1-3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | 54beea2ff7e64c91fe8b8573c256d78924740647b09fc379d86d47ade655e7a5 |
| ppc64le | nodejs-22.23.1-3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | 6c3a7efec4ba16bd385adb934ee23b5e23bebfda0f0e013cc49434b10e938637 |
| ppc64le | nodejs-full-i18n-22.23.1-3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | 7636b652ce6c733ed99188a82ac15724dcd58d5471a624d3caffe9b37bc42d8f |
| ppc64le | v8-12.4-devel-12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | 98984a4316f67e2f4a93911de1eb3e86e9e51338f30f7a7ed16c47fd829f5d02 |
| ppc64le | nodejs-libs-22.23.1-3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | cc938741b04e0454fb8dd040ec2207750cdb47674a09f0a37ce92b3bd1c49a95 |
| ppc64le | npm-10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce.ppc64le.rpm | f563e2b351cbdbfef7665fac740642ae43419978e238a721c76db526c0b50ef4 |
| s390x | v8-12.4-devel-12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce.s390x.rpm | 2b34032c39ff68fce649bde556084f8e9f43bf618629a12a1eacac01e72e0582 |
| s390x | npm-10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce.s390x.rpm | 454df8f00ccc22be799add6a6184de670baecc345bc40e9daf0298995797e109 |
| s390x | nodejs-full-i18n-22.23.1-3.module_el9.8.0+291+0bb98cce.s390x.rpm | 4ba24124dcc939c3c6160ed9d42fab5befcd5e94351ad21c0dac53757da1d9a8 |
| s390x | nodejs-libs-22.23.1-3.module_el9.8.0+291+0bb98cce.s390x.rpm | c61ef8cf078b5cb369ae0c84d464c97154963e8182791237c59a7dfa5bd5c91a |
| s390x | nodejs-22.23.1-3.module_el9.8.0+291+0bb98cce.s390x.rpm | f3f547297ec92a31cf24aeaa9043ba2c0b3df605cb78ccc7ccd4d96ddb855f58 |
| s390x | nodejs-devel-22.23.1-3.module_el9.8.0+291+0bb98cce.s390x.rpm | fd58e20030e384e99c0c31a936d3244bf0056bc8c07ed59755863bc5bc555bf8 |
| x86_64 | nodejs-libs-22.23.1-3.module_el9.8.0+291+0bb98cce.x86_64.rpm | 297507bf2bad133000bd3358570409b2117c5909e4b817aa07dac0d414443e2c |
| x86_64 | nodejs-devel-22.23.1-3.module_el9.8.0+291+0bb98cce.x86_64.rpm | 608d85b5fee9d2913073ff16ce9c2593c06ca6aa515bf5b4805c6a81760135c7 |
| x86_64 | nodejs-full-i18n-22.23.1-3.module_el9.8.0+291+0bb98cce.x86_64.rpm | 7a560e1041405d84bf5e5e04c732ff5e99210dbbf29f0c3e0ec1564dd56af4e5 |
| x86_64 | nodejs-22.23.1-3.module_el9.8.0+291+0bb98cce.x86_64.rpm | 983632743dab07b474f42fcae880b426b1c1a471b2a913a1e08a22496aa4f269 |
| x86_64 | v8-12.4-devel-12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce.x86_64.rpm | ab1411e9253f0db7b7718f6f2578b90bd2ba161da913d78ae5b13f1100dd4ddc |
| x86_64 | npm-10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce.x86_64.rpm | ac13edab98fea9faab9aa09e988fd05c184f2c2c7c78151b2c7cb5d2c335c1be |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Часто задаваемые вопросы
What does ALSA-2026:55601 fix?
Which release is covered?
How do I apply it?
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему