<div class="container">
<h1>Security update for nodejs24</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22565-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-06T20:22:33Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259853">bsc#1259853</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262274">bsc#1262274</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266318">bsc#1266318</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268097">bsc#1268097</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268477">bsc#1268477</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268478">bsc#1268478</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268479">bsc#1268479</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268480">bsc#1268480</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268481">bsc#1268481</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268482">bsc#1268482</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268554">bsc#1268554</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268555">bsc#1268555</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268592">bsc#1268592</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268593">bsc#1268593</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268598">bsc#1268598</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268605">bsc#1268605</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268606">bsc#1268606</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268608">bsc#1268608</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268609">bsc#1268609</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268611">bsc#1268611</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268618">bsc#1268618</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269825">bsc#1269825</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-11525.html">CVE-2026-11525</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-12151.html">CVE-2026-12151</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-2581.html">CVE-2026-2581</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-27135.html">CVE-2026-27135</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-40170.html">CVE-2026-40170</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-42338.html">CVE-2026-42338</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48615.html">CVE-2026-48615</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48617.html">CVE-2026-48617</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48618.html">CVE-2026-48618</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48619.html">CVE-2026-48619</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48928.html">CVE-2026-48928</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48930.html">CVE-2026-48930</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48931.html">CVE-2026-48931</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48933.html">CVE-2026-48933</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48934.html">CVE-2026-48934</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48935.html">CVE-2026-48935</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48937.html">CVE-2026-48937</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-6733.html">CVE-2026-6733</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9496.html">CVE-2026-9496</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9678.html">CVE-2026-9678</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9679.html">CVE-2026-9679</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11525</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11525</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-12151</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-12151</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-12151</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2581</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2581</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27135</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27135</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27135</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27135</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-40170</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-40170</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-40170</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-40170</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42338</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42338</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42338</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42338</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42338</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48615</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48615</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48615</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48615</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48617</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">1.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48617</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48617</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.8</span>
<span class="cvss-vector">CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48618</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48618</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48618</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48618</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.7</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48619</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48619</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48619</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48928</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48928</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48928</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48928</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.2</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48930</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48930</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48930</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48930</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.6</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48931</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48931</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48931</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48931</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48933</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48933</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48934</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48935</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48935</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.0</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48935</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48937</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48937</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6733</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6733</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9496</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9496</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9496</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9496</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9678</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9678</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9679</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9679</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 21 vulnerabilities and has one fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for nodejs24 fixes the following issues</p>
<p>Update to version 24.18.0 (bsc#1269825).</p>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).</li>
<li>CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery
(bsc#1268479).</li>
<li>CVE-2026-9496: pacote: excessive CPU consumption in <code>addGitSha</code> when processing a specially crafted <code>spec.rawSpec</code>
value can lead to DoS (bsc#1266318).</li>
<li>CVE-2026-9678: undici: information disclosure due to improper <code>cache-control</code> header parsing (bsc#1268478).</li>
<li>CVE-2026-9679: undici: HTTP header injection via <code>Set-Cookie</code> percent-decoding (bsc#1268477).</li>
<li>CVE-2026-11525: undici: weakening of cookie <code>SameSite</code> policy due to incorrect parsing of <code>Set-Cookie</code> header
(bsc#1268481).</li>
<li>CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).</li>
<li>CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).</li>
<li>CVE-2026-40170: ngtcp2: qlog <code>parameters_set</code> stack buffer overflow (bsc#1262274).</li>
<li>CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).</li>
<li>CVE-2026-48615: proxy credentials leaked in <code>ERR_PROXY_TUNNEL</code> error message (bsc#1268598).</li>
<li>CVE-2026-48617: permission model enforcement bypass via <code>process.report.writeReport()</code> path misvalidation
(bsc#1268554).</li>
<li>CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to
resolver and verifier hostname normalization mismatch (bsc#1268593).</li>
<li>CVE-2026-48619: unbounded memory growth in <code>node:http2</code> clients via attacker-controlled <code>ORIGIN</code> frames (bsc#1268618).</li>
<li>CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive
hostname matching (bsc#1268605).</li>
<li>CVE-2026-48930: <code>embedded-nul</code> hostnames can lead to silent authority rebinding due to <code>c-string</code> truncation in
resolver bindings (bsc#1268606).</li>
<li>CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in <code>http.Agent</code> (bsc#1268611).</li>
<li>CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).</li>
<li>CVE-2026-48934: TLS host identity verification bypass via session reuse with different <code>servername</code> leads to
unauthorized connections (bsc#1268608).</li>
<li>CVE-2026-48935: permission model bypass via <code>FileHandle.utimes()</code> in the <code>promises</code> API (bsc#1268609).</li>
<li>CVE-2026-48937: servers keep accepting data even after sending a <code>GOAWAY</code> frame (bsc#1268555).</li>
</ul>
<p>Other updates and bugfixes:
- Version 24.18.0:
- doc: update <code>blockList</code> stability status to release candidate
- fs: support caller-supplied <code>readFile()</code> buffers
- http: close pre-request sockets in <code>closeIdleConnections</code>
- loader: implement package maps
- net: support <code>TCP_KEEPINTVL</code> and <code>TCP_KEEPCNT</code> in <code>setKeepAlive</code>
- tls: add <code>certificateCompression</code> option
- vfs: dispatch <code>node:fs/promises</code> to mounted VFS instances
- vfs: add minimal <code>node:vfs</code> subsystem
- For changes in older versions, see https://github.com/nodejs/node/releases.
- Remove <code>update-alternatives</code> from scriptlets if not available.
- Explicitly <code>BuildRequire</code> <code>update-alternatives</code> and mark it as being used in post/postun.
- Add <code>-fno-lifetime-dse</code> to <code>CXXFLAGS</code> to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.</p>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1150=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1150=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>nodejs24-docs-24.18.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>nodejs24-debugsource-24.18.0-160000.1.1</li>
<li>nodejs24-devel-24.18.0-160000.1.1</li>
<li>nodejs24-24.18.0-160000.1.1</li>
<li>npm24-24.18.0-160000.1.1</li>
<li>nodejs24-debuginfo-24.18.0-160000.1.1</li>
<li>corepack24-24.18.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>nodejs24-debugsource-24.18.0-160000.1.1</li>
<li>nodejs24-devel-24.18.0-160000.1.1</li>
<li>nodejs24-24.18.0-160000.1.1</li>
<li>npm24-24.18.0-160000.1.1</li>
<li>nodejs24-debuginfo-24.18.0-160000.1.1</li>
<li>corepack24-24.18.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>nodejs24-docs-24.18.0-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-11525.html">https://www.suse.com/security/cve/CVE-2026-11525.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-12151.html">https://www.suse.com/security/cve/CVE-2026-12151.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-2581.html">https://www.suse.com/security/cve/CVE-2026-2581.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-27135.html">https://www.suse.com/security/cve/CVE-2026-27135.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-40170.html">https://www.suse.com/security/cve/CVE-2026-40170.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-42338.html">https://www.suse.com/security/cve/CVE-2026-42338.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48615.html">https://www.suse.com/security/cve/CVE-2026-48615.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48617.html">https://www.suse.com/security/cve/CVE-2026-48617.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48618.html">https://www.suse.com/security/cve/CVE-2026-48618.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48619.html">https://www.suse.com/security/cve/CVE-2026-48619.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48928.html">https://www.suse.com/security/cve/CVE-2026-48928.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48930.html">https://www.suse.com/security/cve/CVE-2026-48930.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48931.html">https://www.suse.com/security/cve/CVE-2026-48931.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48933.html">https://www.suse.com/security/cve/CVE-2026-48933.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48934.html">https://www.suse.com/security/cve/CVE-2026-48934.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48935.html">https://www.suse.com/security/cve/CVE-2026-48935.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48937.html">https://www.suse.com/security/cve/CVE-2026-48937.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-6733.html">https://www.suse.com/security/cve/CVE-2026-6733.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9496.html">https://www.suse.com/security/cve/CVE-2026-9496.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9678.html">https://www.suse.com/security/cve/CVE-2026-9678.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9679.html">https://www.suse.com/security/cve/CVE-2026-9679.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259853">https://bugzilla.suse.com/show_bug.cgi?id=1259853</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262274">https://bugzilla.suse.com/show_bug.cgi?id=1262274</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266318">https://bugzilla.suse.com/show_bug.cgi?id=1266318</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268097">https://bugzilla.suse.com/show_bug.cgi?id=1268097</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268477">https://bugzilla.suse.com/show_bug.cgi?id=1268477</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268478">https://bugzilla.suse.com/show_bug.cgi?id=1268478</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268479">https://bugzilla.suse.com/show_bug.cgi?id=1268479</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268480">https://bugzilla.suse.com/show_bug.cgi?id=1268480</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268481">https://bugzilla.suse.com/show_bug.cgi?id=1268481</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268482">https://bugzilla.suse.com/show_bug.cgi?id=1268482</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268554">https://bugzilla.suse.com/show_bug.cgi?id=1268554</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268555">https://bugzilla.suse.com/show_bug.cgi?id=1268555</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268592">https://bugzilla.suse.com/show_bug.cgi?id=1268592</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268593">https://bugzilla.suse.com/show_bug.cgi?id=1268593</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268598">https://bugzilla.suse.com/show_bug.cgi?id=1268598</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268605">https://bugzilla.suse.com/show_bug.cgi?id=1268605</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268606">https://bugzilla.suse.com/show_bug.cgi?id=1268606</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268608">https://bugzilla.suse.com/show_bug.cgi?id=1268608</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268609">https://bugzilla.suse.com/show_bug.cgi?id=1268609</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268611">https://bugzilla.suse.com/show_bug.cgi?id=1268611</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268618">https://bugzilla.suse.com/show_bug.cgi?id=1268618</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269825">https://bugzilla.suse.com/show_bug.cgi?id=1269825</a>
</li>
</ul>
</div>