SUSE-CU-2026:13840-1: Security update of bci/nodejs

Sat Nov 7 10:15:55 UTC 2026

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13840-1
Container Tags        : bci/node:24 , bci/node:24-base , bci/node:24.22.1-base , bci/node:24.22.1-base-20.10 , bci/node:latest , bci/nodejs:24 , bci/nodejs:24-base , bci/nodejs:24.22.1-base , bci/nodejs:24.22.1-base-20.10 , bci/nodejs:latest
Container Release     : 20.10
Severity              : important
Type                  : security
References            : 1252390 1262274 1266318 1276224 1286261 1286561 1286562 1286563
                        1286564 1286565 1286566 1286567 1286570 CVE-2026-105481 CVE-2026-105482
                        CVE-2026-105483 CVE-2026-106069 CVE-2026-106072 CVE-2026-106073
                        CVE-2026-106074 CVE-2026-111497 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 15
Released:    Mon Nov  2 13:48:29 2026
Summary:     Security update for nodejs24
Type:        security
Severity:    important
References:  1252390,1262274,1266318,1276224,1286261,1286561,1286562,1286563,1286564,1286565,1286566,1286567,1286570,CVE-2026-105481,CVE-2026-105482,CVE-2026-105483,CVE-2026-106069,CVE-2026-106072,CVE-2026-106073,CVE-2026-106074,CVE-2026-111497
This update for nodejs24 fixes the following issues:

Security issues fixed:

- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
- CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP
  endpoints (bsc#1286566).
- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and
  SEAs, so every process repeats the same values (bsc#1286567).
- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

- 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

Update to 24.22.1:

 - crypto: update root certificates to NSS 3.131.1
 - deps: update c-ares to 1.34.9
 - deps: update timezone to 2026e
 - deps: upgrade openssl sources to openssl-3.5.9
 - deps: update undici to 7.30.1

Update to 24.22.0:

 - crypto: add crypto.parsePKCS12()
 - crypto: discover ciphers and hashes from OpenSSL providers
 - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
 - doc: deprecate Server.prototype._listen2 in node:net
 - net: support sending net.BoundSocket to threads and child processes
 - perf_hooks: implement SlidingWindowHistogram
 - perf_hooks: implement qrde analysis support in Histogram
 - perf_hooks: implement Histogram meanCI API
 - perf_hooks: add CBOR export/import for histogram exchange
 - sqlite: add StatementSync.prototype.close()
 - sqlite: add StatementSync.prototype[Symbol.dispose]()
 - src,lib: add util.markPromiseAsHandled
 - util: implement util.throttle
 - util: implement debounce
for details, see https://nodejs.org/en/blog/release/v24.22.0

Update to 24.21.0:

 - crypto: update root certificates to NSS 3.126
 - crypto: support loading private keys through STORE loaders
 - deps: update Undici to 7.29.1
 - lib,src: improve histogram implementation
 - net: improve performance of net.BlockList
 - perf_hooks: add statistical hypothesis testing to histogram
 - util: add non-throwing MIMEType.parse
for details see https://nodejs.org/en/blog/release/v24.21.0

Update to 24.20.0:

 - async_hooks: add using scopes to AsyncLocalStorage
 - buffer: add end parameter
 - doc: add MikeMcC399 as collaborator
 - lib,permission: add permission.drop
 - loader: implement package maps
 - src,permission: add --permission-audit
 - stream: add node:stream/iter implementation
 - test_runner: add context.log() and test:log event
 - test_runner: report entryFile in TestStream events
 - wasm: enable JSPI
for details see https://github.com/nodejs/node/releases#release-v24.20.0

Update to 24.19.0:

 - buffer: implement blob.textStream()
 - deps: update OpenSSL build config to support compression
 - doc: update blockList stability status to release candidate
 - doc: mark stream.compose stable
 - esm: add --experimental-import-text flag
 - fs: support caller-supplied readFile() buffers
 - http: add httpValidation option to configure header value validation
 - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
 - perf_hooks: sample delay per event loop iteration
 - src: allow empty --experimental-config-file
 - stream: expose ReadableStreamTee
 - tls: report negotiated TLS groups
 - tls: add certificateCompression option
For detailed changes, see https://github.com/nodejs/node/releases#release-v24.19.0

The following package changes have been done:

- nodejs24-24.22.1-160100.1.1 updated
- npm24-24.22.1-160100.1.1 updated
- libbrotlicommon1-1.1.0-160100.2.1 removed
- libbrotlidec1-1.1.0-160100.2.1 removed
- libbrotlienc1-1.1.0-160100.2.1 removed