SUSE-SU-2026:24548-1: important: Security update for nodejs24
SLE-SECURITY-UPDATES
null at suse.de
Tue Nov 10 08:32:22 UTC 2026
# Security update for nodejs24
Announcement ID: SUSE-SU-2026:24548-1
Release Date: 2026-11-02T12:48:29Z
Rating: important
References:
* bsc#1262274
* bsc#1266318
* bsc#1276224
* bsc#1286261
* bsc#1286561
* bsc#1286562
* bsc#1286563
* bsc#1286564
* bsc#1286565
* bsc#1286566
* bsc#1286567
* bsc#1286570
Cross-References:
* CVE-2026-105481
* CVE-2026-105482
* CVE-2026-105483
* CVE-2026-106069
* CVE-2026-106072
* CVE-2026-106073
* CVE-2026-106074
* CVE-2026-111497
CVSS scores:
* CVE-2026-105481 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-105481 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
* CVE-2026-105482 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-105482 ( NVD ): 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-105483 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-105483 ( NVD ): 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-106069 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-106069 ( NVD ): 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-106072 ( SUSE ): 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-106072 ( NVD ): 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-106073 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-106073 ( NVD ): 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-106074 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-106074 ( NVD ): 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-111497 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-111497 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-111497 ( NVD ): 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-111497 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Enterprise Server 16.1
* SUSE Linux Enterprise Server for NVIDIA 16.1
* SUSE Linux Enterprise Server for SAP Applications 16.1
An update that solves eight vulnerabilities and has four fixes can now be
installed.
## Description:
This update for nodejs24 fixes the following issues:
Security issues fixed:
* CVE-2026-105481: Keep-alive socket process a response that was written
before the request was sent (bsc#1286565).
* CVE-2026-105482: dns.resolve truncates names containing NUL char
(bsc#1286561).
* CVE-2026-105483: TLS certificate hostname bypass when the IP is written
fullwidth digits (bsc#1286562).
* CVE-2026-106069: TLS certificate hostname bypass when the host loosely
resolves to an IP address (bsc#1286563).
* CVE-2026-106072: Improper certificate validation for non-canonical IPv4
hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
* CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
* CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are
saved into user-land startup snapshots and SEAs, so every process repeats
the same values (bsc#1286567).
* CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote
code execution (bsc#1286564).
Non security issue fixed:
* "npm install -h" output is truncated (bsc#1276224).
Changes for nodejs24:
Update to 24.22.1:
* crypto: update root certificates to NSS 3.131.1
* deps: update c-ares to 1.34.9
* deps: update timezone to 2026e
* deps: upgrade openssl sources to openssl-3.5.9
* deps: update undici to 7.30.1
Update to 24.22.0:
* crypto: add crypto.parsePKCS12()
* crypto: discover ciphers and hashes from OpenSSL providers
* crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
* doc: deprecate Server.prototype._listen2 in node:net
* net: support sending net.BoundSocket to threads and child processes
* perf_hooks: implement SlidingWindowHistogram
* perf_hooks: implement qrde analysis support in Histogram
* perf_hooks: implement Histogram meanCI API
* perf_hooks: add CBOR export/import for histogram exchange
* sqlite: add StatementSync.prototype.close()
* sqlite: add StatementSync.prototypeSymbol.dispose
* src,lib: add util.markPromiseAsHandled
* util: implement util.throttle
* util: implement debounce for details, see
https://nodejs.org/en/blog/release/v24.22.0
Update to 24.21.0:
* crypto: update root certificates to NSS 3.126
* crypto: support loading private keys through STORE loaders
* deps: update Undici to 7.29.1
* lib,src: improve histogram implementation
* net: improve performance of net.BlockList
* perf_hooks: add statistical hypothesis testing to histogram
* util: add non-throwing MIMEType.parse for details see
https://nodejs.org/en/blog/release/v24.21.0
Update to 24.20.0:
* async_hooks: add using scopes to AsyncLocalStorage
* buffer: add end parameter
* doc: add MikeMcC399 as collaborator
* lib,permission: add permission.drop
* loader: implement package maps
* src,permission: add --permission-audit
* stream: add node:stream/iter implementation
* test_runner: add context.log() and test:log event
* test_runner: report entryFile in TestStream events
* wasm: enable JSPI for details see
https://github.com/nodejs/node/releases#release-v24.20.0
Update to 24.19.0:
* buffer: implement blob.textStream()
* deps: update OpenSSL build config to support compression
* doc: update blockList stability status to release candidate
* doc: mark stream.compose stable
* esm: add --experimental-import-text flag
* fs: support caller-supplied readFile() buffers
* http: add httpValidation option to configure header value validation
* net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
* perf_hooks: sample delay per event loop iteration
* src: allow empty --experimental-config-file
* stream: expose ReadableStreamTee
* tls: report negotiated TLS groups
* tls: add certificateCompression option For detailed changes, see
https://github.com/nodejs/node/releases#release-v24.19.0
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 16.1
zypper in -t patch SUSE-SLES-16.1-15
* SUSE Linux Enterprise Server for SAP Applications 16.1
zypper in -t patch SUSE-SLES-16.1-15
* SUSE Linux Enterprise Server for NVIDIA 16.1
zypper in -t patch SUSE-SLES-16.1-15
## Package List:
* SUSE Linux Enterprise Server 16.1 (aarch64 ppc64le s390x x86_64)
* nodejs24-24.22.1-160100.1.1
* corepack24-24.22.1-160100.1.1
* nodejs24-devel-24.22.1-160100.1.1
* nodejs24-debugsource-24.22.1-160100.1.1
* nodejs24-debuginfo-24.22.1-160100.1.1
* npm24-24.22.1-160100.1.1
* SUSE Linux Enterprise Server 16.1 (noarch)
* nodejs24-docs-24.22.1-160100.1.1
* SUSE Linux Enterprise Server for SAP Applications 16.1 (ppc64le x86_64)
* nodejs24-24.22.1-160100.1.1
* corepack24-24.22.1-160100.1.1
* nodejs24-devel-24.22.1-160100.1.1
* nodejs24-debugsource-24.22.1-160100.1.1
* nodejs24-debuginfo-24.22.1-160100.1.1
* npm24-24.22.1-160100.1.1
* SUSE Linux Enterprise Server for SAP Applications 16.1 (noarch)
* nodejs24-docs-24.22.1-160100.1.1
* SUSE Linux Enterprise Server for NVIDIA 16.1 (aarch64)
* nodejs24-24.22.1-160100.1.1
* corepack24-24.22.1-160100.1.1
* nodejs24-devel-24.22.1-160100.1.1
* nodejs24-debugsource-24.22.1-160100.1.1
* nodejs24-debuginfo-24.22.1-160100.1.1
* npm24-24.22.1-160100.1.1
* SUSE Linux Enterprise Server for NVIDIA 16.1 (noarch)
* nodejs24-docs-24.22.1-160100.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-105481.html
* https://www.suse.com/security/cve/CVE-2026-105482.html
* https://www.suse.com/security/cve/CVE-2026-105483.html
* https://www.suse.com/security/cve/CVE-2026-106069.html
* https://www.suse.com/security/cve/CVE-2026-106072.html
* https://www.suse.com/security/cve/CVE-2026-106073.html
* https://www.suse.com/security/cve/CVE-2026-106074.html
* https://www.suse.com/security/cve/CVE-2026-111497.html
* https://bugzilla.suse.com/show_bug.cgi?id=1262274
* https://bugzilla.suse.com/show_bug.cgi?id=1266318
* https://bugzilla.suse.com/show_bug.cgi?id=1276224
* https://bugzilla.suse.com/show_bug.cgi?id=1286261
* https://bugzilla.suse.com/show_bug.cgi?id=1286561
* https://bugzilla.suse.com/show_bug.cgi?id=1286562
* https://bugzilla.suse.com/show_bug.cgi?id=1286563
* https://bugzilla.suse.com/show_bug.cgi?id=1286564
* https://bugzilla.suse.com/show_bug.cgi?id=1286565
* https://bugzilla.suse.com/show_bug.cgi?id=1286566
* https://bugzilla.suse.com/show_bug.cgi?id=1286567
* https://bugzilla.suse.com/show_bug.cgi?id=1286570
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261110/84064f11/attachment.htm>
More information about the sle-security-updates
mailing list