SUSE-CU-2026:13623-1: Security update of bci/nodejs

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13623-1
Container Tags        : bci/node:22 , bci/node:22-sles15 , bci/node:22.23.4 , bci/node:22.23.4-24.72 , bci/nodejs:22 , bci/nodejs:22-sles15 , bci/nodejs:22.23.4 , bci/nodejs:22.23.4-24.72
Container Release     : 24.72
Severity              : important
Type                  : security
References            : 1286261 1286561 1286563 1286564 1286565 1286566 1286567 1286570
                        CVE-2026-105481 CVE-2026-105482 CVE-2026-106069 CVE-2026-106072
                        CVE-2026-106073 CVE-2026-106074 CVE-2026-111497 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5036-1
Released:    Mon Nov  2 17:21:07 2026
Summary:     Security update for nodejs22
Type:        security
Severity:    important
References:  1286261,1286561,1286563,1286564,1286565,1286566,1286567,1286570,CVE-2026-105481,CVE-2026-105482,CVE-2026-106069,CVE-2026-106072,CVE-2026-106073,CVE-2026-106074,CVE-2026-111497
This update for nodejs22 fixes the following issues:

- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP
  endpoints (bsc#1286566).
- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and
  SEAs, so every process repeats the same values (bsc#1286567).
- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

- Update to 22.23.4:
 - deps: update c-ares to 1.34.9
 - deps: update timezone to 2026e
 - deps: upgrade openssl sources to openssl-3.5.9
 - deps: update sqlite to 3.53.4
 - deps: update undici to 6.29.1
- Update to 22.23.3:
 - deps: update corepack to 0.36.0
 - deps: upgrade npm to 10.9.9
 - deps: update icu to 78.3
 - deps: update Undici to 6.28.1
 - node-api: support SharedArrayBuffer in napi_create_typedarray
 - node-api: add napi_create_external_sharedarraybuffer


The following package changes have been done:

- nodejs22-22.23.4-150700.3.21.1 updated
- npm22-22.23.4-150700.3.21.1 updated