Red Hat Product Errata RHSA-2026:47058 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47058 - Security Advisory Overview Updated Packages Synopsis Important: nodejs:22 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity BZ - 2498116 - CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header BZ - 2498120 - CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb CVEs CVE-2026-13149 CVE-2026-59873 CVE-2026-59874 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM nodejs-22.23.1-2.module+el9.8.0+24538+3f176d52.src.rpm SHA-256: e2474475abc433d2b04d27c1599567b974f30c2a89f39f8a38363f8d31ec5af8 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.src.rpm SHA-256: dbd645f5f2554af305a46554767e1da8d2d8b832e0bfae2046ecae1d70bf7170 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.src.rpm SHA-256: 7d1e9988b726d74470a1a1bfd2a6feab76316edfffe5d4807dca5ae4fd23ea1f x86_64 nodejs-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: e77b55238f02baf44787f2b1e377ada5e7e42c919f397dc16312a057d1648369 nodejs-debuginfo-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 7df5be9596f73a9bc4c3f07b60d14ad76071fbe4676725cadf1dc4a2339a2417 nodejs-debugsource-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 5eae995d001aec862c794e188248da194cf4924774b315fbd09ad2f0fa909c1a nodejs-devel-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 0bca7b958b271cf8db0041b1af050e9e27307134eaf891288d4fe1c3f42d9b18 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-full-i18n-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 780f712da5f13fbb46748ca26e2d9250a270d48634c27a78044e15b5ad8ad0bc nodejs-libs-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 2ca708cc615680cfb99ece0c1e3735151b704b563d0724b248c1cca5ffa9aa8c nodejs-libs-debuginfo-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: e8f1e93bb08b445802bd062f35d9608ddc985cf07ae1cc0a3ee9e9f1ff1255f6 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 69c62d097a744fb130d753267045dc64009e6f7071a983d9d3a112a18daf1ad6 npm-10.9.8-1.22.23.1.2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 792e6f01eba9934a03ecbd9b44d14c6ecf3dde8323f7612b257f0f557c7dba50 v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 8e3297a9fe02638cce39292cd006d36cd0ca8d0d811dcc1529effa0492e680e6 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 69c62d097a744fb130d753267045dc64009e6f7071a983d9d3a112a18daf1ad6 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 69c62d097a744fb130d753267045dc64009e6f7071a983d9d3a112a18daf1ad6 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 69c62d097a744fb130d753267045dc64009e6f7071a983d9d3a112a18daf1ad6 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM nodejs-22.23.1-2.module+el9.8.0+24538+3f176d52.src.rpm SHA-256: e2474475abc433d2b04d27c1599567b974f30c2a89f39f8a38363f8d31ec5af8 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.src.rpm SHA-256: dbd645f5f2554af305a46554767e1da8d2d8b832e0bfae2046ecae1d70bf7170 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.src.rpm SHA-256: 7d1e9988b726d74470a1a1bfd2a6feab76316edfffe5d4807dca5ae4fd23ea1f x86_64 nodejs-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: e77b55238f02baf44787f2b1e377ada5e7e42c919f397dc16312a057d1648369 nodejs-debuginfo-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 7df5be9596f73a9bc4c3f07b60d14ad76071fbe4676725cadf1dc4a2339a2417 nodejs-debugsource-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 5eae995d001aec862c794e188248da194cf4924774b315fbd09ad2f0fa909c1a nodejs-devel-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 0bca7b958b271cf8db0041b1af050e9e27307134eaf891288d4fe1c3f42d9b18 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-full-i18n-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 780f712da5f13fbb46748ca26e2d9250a270d48634c27a78044e15b5ad8ad0bc nodejs-libs-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 2ca708cc615680cfb99ece0c1e3735151b704b563d0724b248c1cca5ffa9aa8c nodejs-libs-debuginfo-22.23.1-2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: e8f1e93bb08b445802bd062f35d9608ddc985cf07ae1cc0a3ee9e9f1ff1255f6 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 69c62d097a744fb130d753267045dc64009e6f7071a983d9d3a112a18daf1ad6 npm-10.9.8-1.22.23.1.2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 792e6f01eba9934a03ecbd9b44d14c6ecf3dde8323f7612b257f0f557c7dba50 v8-12.4-devel-12.4.254.21-1.22.23.1.2.module+el9.8.0+24538+3f176d52.x86_64.rpm SHA-256: 8e3297a9fe02638cce39292cd006d36cd0ca8d0d811dcc1529effa0492e680e6 nodejs-docs-22.23.1-2.module+el9.8.0+24538+3f176d52.noarch.rpm SHA-256: c7f9a8b6e8d53ed52acc4ab421a3d8a4e057cba1c11a67d0b47b35b593686516 nodejs-nodemon-3.1.14-1.module+el9.8.0+24540+c30b2ffe.noarch.rpm SHA-256: 4b5eb17f97e82f95c5dda888cc74c8b8a348265bb68b08130b9b4947fe5dac48 nodejs-packaging-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-256: 6c80cf85e6c3608c2a3bee9b0e687d713797a944ff352d14dbc2765c6beab1da nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24156+bb41d456.noarch.rpm SHA-2