Red Hat Product Errata RHSA-2026:47057 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47057 - Security Advisory Overview Updated Packages Synopsis Important: nodejs:24 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity BZ - 2498116 - CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header BZ - 2498120 - CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb CVEs CVE-2026-13149 CVE-2026-59873 CVE-2026-59874 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM nodejs-24.18.0-3.module+el9.8.0+24537+83ec84e1.src.rpm SHA-256: 6bc4c64040ad8116740e81b36b771763ab43471cfc5930ffddb346ef7b7271e6 nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.src.rpm SHA-256: 12a63f7dfdf49aeeba8b1dceb2731934b301df9e57faf69a5276424367989a57 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.src.rpm SHA-256: a0f391c74993bc591572766a4c390fbb4a14ae8f621fb124f5378fd3e0c2e208 x86_64 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 nodejs-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: 041c26d0f7dd654667dcda4a50e00aea612b53d440544a60f82059c157abb529 nodejs-debuginfo-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: e6fe1cb25ef33b81dfe989674d889dc15e4d911ea4ce18daa29026de010aab58 nodejs-debugsource-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: 98704d4228c1a005827fcbde03f6af6f85116d0ac7f6893bb8aa304312526f47 nodejs-devel-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: 4d6cef0f3c83c1ddafefff58e9b930e7c5d3995ffc5e54c2c01fed9939f4a451 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-full-i18n-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: 1dc8dbb8c32e6581d5c174af453711904c6b8c18c32a10450af4dd3a59fba2a0 nodejs-libs-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: c78972e6fbbd6601de63363e73fe72ae610ff46fdcc2f5c8a997fc133d1a8422 nodejs-libs-debuginfo-24.18.0-3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: c201894d8db79e17239a9f221244a09caac8e77d3dae57e29b3748cecd3064a3 nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 v8-13.6-devel-13.6.233.17-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.x86_64.rpm SHA-256: c95905d481f3a25a5d0e5c43d49bd93f79768ed5f83b5e52dc15b403be0d9498 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM nodejs-24.18.0-3.module+el9.8.0+24537+83ec84e1.src.rpm SHA-256: 6bc4c64040ad8116740e81b36b771763ab43471cfc5930ffddb346ef7b7271e6 nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.src.rpm SHA-256: 12a63f7dfdf49aeeba8b1dceb2731934b301df9e57faf69a5276424367989a57 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.src.rpm SHA-256: a0f391c74993bc591572766a4c390fbb4a14ae8f621fb124f5378fd3e0c2e208 x86_64 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df76fdda90d85dce1777d9a14581a2c00f783d56b5a0060430f5b0d588fe2d npm-11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2b9a32605217b9bb12e31b6aa69f90bf4578cf6e04c3b1c66d70464f975bf449 nodejs-docs-24.18.0-3.module+el9.8.0+24537+83ec84e1.noarch.rpm SHA-256: 2da08d76d35cdb610c717182f70aaee07589dbc4167b9741212ff0adcf00999e nodejs-nodemon-3.1.14-2.module+el9.8.0+24539+0ea88729.noarch.rpm SHA-256: 74f067514ea81520115ed81be6cfaf1c22c54753955f5e0d944040de96c4eca3 nodejs-packaging-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 2017dd0b74b58b131a5ab072d257afd7c90eb1f1b30e57372b8bb3d7cf93330b nodejs-packaging-bundler-2021.06-6.module+el9.8.0+24355+35d95b59.noarch.rpm SHA-256: 78df7