SUSE-CU-2026:13646-1: Security update of bci/nodejs

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13646-1
Container Tags        : bci/node:22 , bci/node:22-sles15 , bci/node:22.23.4 , bci/node:22.23.4-24.73 , bci/nodejs:22 , bci/nodejs:22-sles15 , bci/nodejs:22.23.4 , bci/nodejs:22.23.4-24.73
Container Release     : 24.73
Severity              : important
Type                  : security
References            : 1268414 1268419 1268423 1268424 1268425 1268426 1268427 1277477
                        1277478 1277482 1278173 1285008 1285010 1285011 1285012 1285013
                        1285014 1285015 1285016 1285017 1285018 1285021 1285022 1285023
                        1285024 1285026 1285027 1285028 1285029 1285030 1285031 1287781
                        CVE-2026-107929 CVE-2026-11352 CVE-2026-11564 CVE-2026-11586
                        CVE-2026-11856 CVE-2026-12064 CVE-2026-18924 CVE-2026-19931 CVE-2026-80255
                        CVE-2026-82209 CVE-2026-86409 CVE-2026-86410 CVE-2026-86411 CVE-2026-86412
                        CVE-2026-86413 CVE-2026-86414 CVE-2026-87861 CVE-2026-87862 CVE-2026-87863
                        CVE-2026-87864 CVE-2026-8932 CVE-2026-92386 CVE-2026-92387 CVE-2026-92388
                        CVE-2026-92389 CVE-2026-92390 CVE-2026-92391 CVE-2026-92392 CVE-2026-94265
                        CVE-2026-94266 CVE-2026-9546 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5068-1
Released:    Tue Nov  3 09:13:11 2026
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1268414,1268419,1268423,1268424,1268425,1268426,1268427,1277477,1277478,1277482,1278173,1285008,1285010,1285011,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285024,1285026,1285027,1285028,1285029,1285030,1285031,1287781,CVE-2026-107929,CVE-2026-11352,CVE-2026-11564,CVE-2026-11586,CVE-2026-11856,CVE-2026-12064,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86411,CVE-2026-86412,CVE-2026-86413,CVE-2026-86414,CVE-2026-87861,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94265,CVE-2026-94266,CVE-2026-9546
This update for curl fixes the following issues:

- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
  
Changes for curl:

- Updated curl to version 8.22.0. (jsc#PED-16984)


The following package changes have been done:

- libcurl4-8.22.0-150700.7.33.1 updated
- curl-8.22.0-150700.7.33.1 updated