diff --git a/nodejs.spec b/nodejs.spec
index c2d1e27..326edeb 100644
--- a/nodejs.spec
+++ b/nodejs.spec
@@ -30,7 +30,7 @@
 # This is used by both the nodejs package and the npm subpackage that
 # has a separate version - the name is special so that rpmdev-bumpspec
 # will bump this rather than adding .1 to the end.
-%global baserelease 2
+%global baserelease 1
 
 %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
@@ -42,7 +42,7 @@
 %global nodejs_epoch 1
 %global nodejs_major 16
 %global nodejs_minor 20
-%global nodejs_patch 1
+%global nodejs_patch 2
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
 %global nodejs_soversion 93
@@ -722,6 +722,10 @@ end
 
 
 %changelog
+* Wed Aug 30 2023 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.20.2-1
+- Rebase to 16.20.2
+  Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
+
 * Mon Jul 31 2023 Honza Horak <hhorak@redhat.com> - 1:16.20.1-2
 - Fix segfault that happens when processing fips-related options
   Resolves: BZ#2227796
diff --git a/sources b/sources
index 13dcd59..cc3bce9 100644
--- a/sources
+++ b/sources
@@ -1,6 +1,6 @@
-SHA512 (node-v16.20.1-stripped.tar.gz) = ea33b6301be6c24ad631c0fc5b6df5af41a3047db8557421062561c5e0da7f67c9837a330098235a8a160f2b680fccd80931f5887745db0e6f9dbf366f1ed4f6
+SHA512 (node-v16.20.2-stripped.tar.gz) = 9ab65824a56382a72075533274ba5a86dc1fc2adb0215c81c6c9084c6dea45c3107630c0d203557cac867e00caf1c5449a97445cd5914c3e870d9055d2c409de
 SHA512 (icu4c-71_1-src.tgz) = 1fd2a20aef48369d1f06e2bb74584877b8ad0eb529320b976264ec2db87420bae242715795f372dbc513ea80047bc49077a064e78205cd5e8b33d746fd2a2912
 SHA512 (cjs-module-lexer-1.2.2.tar.gz) = 2c8e9caf2231ca7d61e71936305389774859aca9b5c86c63489c9a62a81f4736f99477c3f0cbb41077bb7924fdd23e0f24b7bce858e42fb0f87e7c0ffc87afeb
-SHA512 (undici-5.20.0.tar.gz) = 49fd4d9f73bd44232612963ca51e54da9e94a64504f7cbf426b3c04ec8ddcc1c4a060d7f713d9345452094039ae1b8938224bfd49bb32d0be723963b3db31edc
+SHA512 (undici-5.20.0.tar.gz) = 75a4c164081bbc8114aceeb48680db003cb014d7f92f157d03e9a36c775606a4bede5dbba236ba1722a651ab91968cb192eeae671ec1024f826c4b452d4e20ff
 SHA512 (wasi-sdk-wasi-sdk-11.tar.gz) = cb37f357b09431a3efad26141d83dce63232a35b536d9a7bd341d4d9627a0a3d4bd4d57504b6e3dab421942d2c168a96da2a6be889aab3f9a2852fc5a3200d3c
 SHA512 (wasi-sdk-wasi-sdk-14.tar.gz) = 4fecb3d9c04b91eb2388a9e51d49fbff6f22b81f9945a07ecdbfe479c96dad1e3b673b8bee24842b0dae5294129a9cb35dcf8e5ecf45437a6d01fb6e0fd13645