diff --git a/.gitignore b/.gitignore
index 83a09f9..165727a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,5 @@
 SOURCES/cjs-module-lexer-1.2.2.tar.gz
 SOURCES/icu4c-73_2-src.tgz
-SOURCES/node-v18.18.2-stripped.tar.gz
-SOURCES/undici-5.26.3.tar.gz
+SOURCES/node-v18.19.0-stripped.tar.gz
+SOURCES/undici-5.26.4.tar.gz
 SOURCES/wasi-sdk-11.0-linux.tar.gz
diff --git a/.nodejs.metadata b/.nodejs.metadata
index c1dee03..1c243d7 100644
--- a/.nodejs.metadata
+++ b/.nodejs.metadata
@@ -1,5 +1,5 @@
 b0a91341ecf6c68a9d59a1c57d000fbbcc771679 SOURCES/cjs-module-lexer-1.2.2.tar.gz
 3d94969b097189bf5479c312d9593d2d252f5a73 SOURCES/icu4c-73_2-src.tgz
-d30d3f7338020a16a5e2417b6c6def016b2852d8 SOURCES/node-v18.18.2-stripped.tar.gz
-edb9aa7012424bfe24514b5ea5b99ef3733651ab SOURCES/undici-5.26.3.tar.gz
+86902e7f408e3689e3048ae7ec047fb658be6a6e SOURCES/node-v18.19.0-stripped.tar.gz
+d1dde2c4db1554f1f152d98f5fed64ea606be946 SOURCES/undici-5.26.4.tar.gz
 ff114dd45b4efeeae7afe4621bfc6f886a475b4b SOURCES/wasi-sdk-11.0-linux.tar.gz
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
index cb90419..ae3dc47 100644
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@@ -29,7 +29,7 @@
 # This is used by both the nodejs package and the npm subpackage that
 # has a separate version - the name is special so that rpmdev-bumpspec
 # will bump this rather than adding .1 to the end.
-%global baserelease 2
+%global baserelease 1
 
 %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
@@ -40,8 +40,8 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 18
-%global nodejs_minor 18
-%global nodejs_patch 2
+%global nodejs_minor 19
+%global nodejs_patch 0
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
 %global nodejs_soversion 108
@@ -65,7 +65,7 @@
 
 # c-ares - from deps/cares/include/ares_version.h
 # https://github.com/nodejs/node/pull/9332
-%global c_ares_version 1.19.1
+%global c_ares_version 1.20.1
 
 # llhttp - from deps/llhttp/include/llhttp.h
 %global llhttp_version 6.0.11
@@ -126,7 +126,7 @@
 
 # npm - from deps/npm/package.json
 %global npm_epoch 1
-%global npm_version 9.8.1
+%global npm_version 10.2.3
 
 # In order to avoid needing to keep incrementing the release version for the
 # main package forever, we will just construct one for npm that is guaranteed
@@ -135,7 +135,7 @@
 %global npm_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release}
 
 # uvwasi - from deps/uvwasi/include/uvwasi.h
-%global uvwasi_version 0.0.18
+%global uvwasi_version 0.0.19
 
 # histogram_c - assumed from timestamps
 %global histogram_version 0.11.8
@@ -181,10 +181,10 @@ Source101: cjs-module-lexer-1.2.2.tar.gz
 Source111: https://github.com/WebAssembly/wasi-sdk/archive/wasi-sdk-11/wasi-sdk-11.0-linux.tar.gz
 
 # Version: jq '.version' deps/undici/src/package.json
-# Original: https://github.com/nodejs/undici/archive/refs/tags/v5.26.3.tar.gz
-# Adjustments: rm -f undici-5.26.3/lib/llhttp/llhttp*.wasm
+# Original: https://github.com/nodejs/undici/archive/refs/tags/v5.26.4.tar.gz
+# Adjustments: rm -f undici-5.26.4/lib/llhttp/llhttp*.wasm
 # Build uses alpine image, see alpine for sources for wasi-sdk
-Source102: undici-5.26.3.tar.gz
+Source102: undici-5.26.4.tar.gz
 
 # Disable running gyp on bundled deps we don't use
 Patch1: 0001-Disable-running-gyp-on-shared-deps.patch
@@ -440,7 +440,7 @@ make BUILDTYPE=Release %{?_smp_mflags}
 
 # Extract the ICU data and convert it to the appropriate endianness
 pushd deps/
-tar xzf %{SOURCE3}
+tar -xzf %{SOURCE3}
 
 pushd icu/source
 
@@ -628,8 +628,9 @@ NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/nod
 
 
 %changelog
-* Sun Oct 15 2023 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:18.18.2-2
-- Bump nghttp too
+* Thu Jan 18 2024 Jan Staněk <jstanek@redhat.com> - 1:18.19.0-1
+- Rebase to version 18.19.0
+  Resolves: RHEL-21438
 
 * Sat Oct 14 2023 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:18.18.2-1
 - Rebase to 18.18.2 (Security release)