{"schema_version":"1.7.5","id":"SUSE-SU-2026:22565-1","published":"2026-07-06T20:22:30Z","modified":"2026-07-15T18:24:11.411077480Z","related":["CVE-2026-11525","CVE-2026-12151","CVE-2026-2581","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9678","CVE-2026-9679"],"upstream":["CVE-2026-11525","CVE-2026-12151","CVE-2026-2581","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9678","CVE-2026-9679"],"summary":"Security update for nodejs24","details":"This update for nodejs24 fixes the following issues\n\nUpdate to version 24.18.0 (bsc#1269825).\n\nSecurity issues fixed:\n\n- CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing (bsc#1268478).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive\n  hostname matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername` leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n\nOther updates and bugfixes:\n- Version 24.18.0:\n  - doc: update `blockList` stability status to release candidate\n  - fs: support caller-supplied `readFile()` buffers\n  - http: close pre-request sockets in `closeIdleConnections`\n  - loader: implement package maps\n  - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`\n  - tls: add `certificateCompression` option\n  - vfs: dispatch `node:fs/promises` to mounted VFS instances\n  - vfs: add minimal `node:vfs` subsystem\n- For changes in older versions, see https://github.com/nodejs/node/releases.\n- Remove `update-alternatives` from scriptlets if not available.\n- Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.\n- Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.\n","affected":[{"package":{"name":"nodejs24","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/nodejs24&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"corepack24":"24.18.0-160000.1.1","nodejs24":"24.18.0-160000.1.1","nodejs24-devel":"24.18.0-160000.1.1","nodejs24-docs":"24.18.0-160000.1.1","npm24":"24.18.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22565-1.json"}},{"package":{"name":"nodejs24","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/nodejs24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"corepack24":"24.18.0-160000.1.1","nodejs24":"24.18.0-160000.1.1","nodejs24-devel":"24.18.0-160000.1.1","nodejs24-docs":"24.18.0-160000.1.1","npm24":"24.18.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22565-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622565-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259853"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262274"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268097"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268477"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268478"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268479"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268480"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268481"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268482"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268554"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268555"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268592"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268593"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268598"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268605"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268606"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268608"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268609"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268611"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268618"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269825"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-11525"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-12151"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-2581"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27135"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-40170"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42338"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48615"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48617"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48618"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48619"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48928"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48930"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48931"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48933"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48934"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48935"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48937"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6733"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9496"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9678"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9679"}]}