diff --git a/.gitignore b/.gitignore
index 1234ad8..4fff4ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/node-v10.14.1-stripped.tar.gz
+SOURCES/node-v10.16.3-stripped.tar.gz
diff --git a/.nodejs.metadata b/.nodejs.metadata
index 2ebce95..cc922a4 100644
--- a/.nodejs.metadata
+++ b/.nodejs.metadata
@@ -1 +1 @@
-74e22337960b5807cf644ebac496570bef9422d3 SOURCES/node-v10.14.1-stripped.tar.gz
+ff532bed1adf4182d3a4c0cec160a357bd08d3fa SOURCES/node-v10.16.3-stripped.tar.gz
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
index 4da436b..afcec29 100644
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@@ -20,11 +20,11 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 10
-%global nodejs_minor 14
-%global nodejs_patch 1
+%global nodejs_minor 16
+%global nodejs_patch 3
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 %global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}
-%global nodejs_release 1
+%global nodejs_release 2
 
 # == Bundled Dependency Versions ==
 # v8 - from deps/v8/include/v8-version.h
@@ -39,7 +39,7 @@
 # c-ares - from deps/cares/include/ares_version.h
 # https://github.com/nodejs/node/pull/9332
 %global c_ares_major 1
-%global c_ares_minor 14
+%global c_ares_minor 15
 %global c_ares_patch 0
 %global c_ares_version %{c_ares_major}.%{c_ares_minor}.%{c_ares_patch}
 
@@ -51,14 +51,14 @@
 
 # libuv - from deps/uv/include/uv/version.h
 %global libuv_major 1
-%global libuv_minor 23
-%global libuv_patch 2
+%global libuv_minor 28
+%global libuv_patch 0
 %global libuv_version %{libuv_major}.%{libuv_minor}.%{libuv_patch}
 
 # nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
 %global nghttp2_major 1
-%global nghttp2_minor 34
-%global nghttp2_patch 0
+%global nghttp2_minor 39
+%global nghttp2_patch 2
 %global nghttp2_version %{nghttp2_major}.%{nghttp2_minor}.%{nghttp2_patch}
 
 # ICU - from configure.py in the configure_intl() function
@@ -84,8 +84,8 @@
 # npm - from deps/npm/package.json
 %global npm_epoch 1
 %global npm_major 6
-%global npm_minor 4
-%global npm_patch 1
+%global npm_minor 9
+%global npm_patch 0
 %global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
 
 # In order to avoid needing to keep incrementing the release version for the
@@ -129,6 +129,7 @@ BuildRequires: python3-devel
 BuildRequires: zlib-devel
 BuildRequires: gcc >= 4.9.4
 BuildRequires: gcc-c++ >= 4.9.4
+BuildRequires: nodejs-packaging
 
 #%if ! 0%%{?bootstrap}
 %if %{with bootstrap}
@@ -136,7 +137,6 @@ Provides: bundled(http-parser) = %{http_parser_version}
 Provides: bundled(libuv) = %{libuv_version}
 Provides: bundled(nghttp2) = %{nghttp2_version}
 %else
-BuildRequires: nodejs-packaging
 BuildRequires: systemtap-sdt-devel
 BuildRequires: http-parser-devel >= 2.7.0
 Requires: http-parser >= 2.7.0
@@ -500,6 +500,12 @@ end
 %{_pkgdocdir}/npm/doc
 
 %changelog
+* Tue Sep 10 2019 Jan Staněk <jstanek@redhat.com> - 1:10.16.3-1
+- Rebase to 10.16.3 to fix CVE-2019-9511 to CVE-2019-9518
+
+* Thu Mar 14 2019 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:10.14.1-2
+- move nodejs-packaging BR out of conditional
+
 * Tue Dec 11 2018 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:10.14.1-1
 - Resolves: RHBZ#1644207
 - fixes node-gyp permissions