{"schema_version":"1.7.5","id":"SUSE-SU-2026:2695-1","published":"2026-06-30T09:06:44Z","modified":"2026-07-01T09:45:06.071847973Z","related":["CVE-2026-11525","CVE-2026-12151","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9679"],"upstream":["CVE-2026-11525","CVE-2026-12151","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9679"],"summary":"Security update for nodejs22","details":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).\n- CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).\n- CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).\n- CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).\n- CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).\n- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).\n- CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).\n- CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).\n- CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).\n- CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).\n- CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).\n- CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).\n- CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` ( bsc#1266318).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n","affected":[{"package":{"name":"nodejs22","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-150700.3.12.1"}]}],"ecosystem_specific":{"binaries":[{"nodejs22":"22.23.0-150700.3.12.1","nodejs22-devel":"22.23.0-150700.3.12.1","nodejs22-docs":"22.23.0-150700.3.12.1","npm22":"22.23.0-150700.3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2695-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262695-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259853"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262274"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268097"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268477"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268479"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268481"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268482"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268554"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268555"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268592"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268593"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268598"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268605"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268606"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268608"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268609"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268611"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268618"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-11525"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-12151"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27135"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-40170"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42338"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48615"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48617"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48618"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48619"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48928"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48930"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48931"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48933"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48934"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48935"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48937"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6733"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9496"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9679"}]}