Linux · Security advisory · August 18, 2026

ELSA-2026-55603: Security update for 10 packages

ELSA-2026-55603, released August 18, 2026, fixes 6 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0065
51st percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 91:24.18.0-6.module+el9.8.0+90993+075b4fd6
nodejs-develol 91:24.18.0-6.module+el9.8.0+90993+075b4fd6
nodejs-docsol 91:24.18.0-6.module+el9.8.0+90993+075b4fd6
nodejs-full-i18nol 91:24.18.0-6.module+el9.8.0+90993+075b4fd6
nodejs-libsol 91:24.18.0-6.module+el9.8.0+90993+075b4fd6
nodejs-nodemonol 90:3.1.14-3.module+el9.8.0+90993+075b4fd6
nodejs-packagingol 90:2021.06-6.module+el9.8.0+90946+13dc792a
nodejs-packaging-bundlerol 90:2021.06-6.module+el9.8.0+90946+13dc792a
npmol 91:11.16.0-1.24.18.0.6.module+el9.8.0+90993+075b4fd6
v8-13.6-develol 93:13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-69152 nodejs-nodemon: The brace-expansion library generates arbitrary strings containing a common prefix and suffix 8.6 0.0065 None reported
High CVE-2026-14257 nodejs22: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion 8.6 0.0064 None reported
High CVE-2026-69192 node-ip-address: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript 8.6 0.0047 None reported
High CVE-2026-54272 node-ip-address: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript 8.6 0.0040 None reported
High CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension 8.6 0.0020 None reported
High CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate 8.6 0.0018 None reported
Showing 1 to 6 of 6 1