Linux · Security advisory · August 28, 2026

RHSA-2026:54530: Security update for 10 packages

RHSA-2026:54530, released August 28, 2026, fixes 5 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0065
51st percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsRHEL 81:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-develRHEL 81:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-docsRHEL 81:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-full-i18nRHEL 81:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-libsRHEL 81:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-nodemonRHEL 80:3.1.14-2.module+el8.10.0+24640+6eba5e6e
nodejs-packagingRHEL 80:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundlerRHEL 80:2021.06-6.module+el8.10.0+24500+8eb51621
npmRHEL 81:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
v8-12.4-develRHEL 83:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-69152 nodejs-nodemon: The brace-expansion library generates arbitrary strings containing a common prefix and suffix 8.6 0.0065 None reported
High CVE-2026-14257 nodejs22: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion 8.6 0.0064 None reported
High CVE-2026-69192 node-ip-address: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript 8.6 0.0047 None reported
High CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension 8.6 0.0020 None reported
High CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate 8.6 0.0018 None reported
Showing 1 to 5 of 5 1