Linux · Security advisory · February 17, 2026

ELSA-2026-2781: Security update for 10 packages

ELSA-2026-2781, released February 17, 2026, fixes 6 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0396
90th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 91:24.13.0-1.module+el9.7.0+90805+68a1aa93
nodejs-develol 91:24.13.0-1.module+el9.7.0+90805+68a1aa93
nodejs-docsol 91:24.13.0-1.module+el9.7.0+90805+68a1aa93
nodejs-full-i18nol 91:24.13.0-1.module+el9.7.0+90805+68a1aa93
nodejs-libsol 91:24.13.0-1.module+el9.7.0+90805+68a1aa93
nodejs-nodemonol 90:3.0.3-3.module+el9.7.0+90805+68a1aa93
nodejs-packagingol 90:2021.06-6.module+el9.7.0+90805+68a1aa93
nodejs-packaging-bundlerol 90:2021.06-6.module+el9.7.0+90805+68a1aa93
npmol 91:11.6.2-1.24.13.0.1.module+el9.7.0+90805+68a1aa93
v8-13.6-develol 93:13.6.233.17-1.24.13.0.1.module+el9.7.0+90805+68a1aa93

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-59465 Node.js 20 and 3 others: Uncontrolled Resource Consumption 7.5 0.0396 None reported
High CVE-2025-55131 Node.js and 3 others: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 7.5 0.0346 None reported
High CVE-2025-55130 Node.js 20 and 3 others: Authentication Bypass by Alternate Name 9.1 0.0170 None reported
High CVE-2026-21637 HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers 7.5 0.0112 N/A
High CVE-2025-59466 Node.js 20 and 3 others: Uncaught Exception 7.5 0.0068 None reported
High CVE-2025-55132 Node.js 20 and 3 others: Incorrect Default Permissions 7.5 0.0026 None reported
Showing 1 to 6 of 6 1