SUSE-SU-2026:4261-1: important: Security update for nodejs18
SLE-UPDATES
null at suse.de
Fri Sep 18 12:32:58 UTC 2026
# Security update for nodejs18
Announcement ID: SUSE-SU-2026:4261-1
Release Date: 2026-09-18T07:44:29Z
Rating: important
References:
* bsc#1236258
* bsc#1243218
* bsc#1243220
* bsc#1254738
* bsc#1256570
* bsc#1256573
* bsc#1256574
* bsc#1256576
* bsc#1256848
* bsc#1259853
* bsc#1260455
* bsc#1260463
* bsc#1260480
* bsc#1260494
* bsc#1268477
* bsc#1268479
* bsc#1268481
* bsc#1268482
* bsc#1268555
* bsc#1268592
* bsc#1268593
* bsc#1268605
* bsc#1268606
* bsc#1268608
* bsc#1268609
* bsc#1268611
* bsc#1268618
* bsc#1269825
* bsc#1272941
* bsc#1272942
* bsc#1272943
* bsc#1272944
* bsc#1272945
* bsc#1272947
* bsc#1272948
* bsc#1272951
* bsc#1272958
* bsc#1273591
* bsc#1273593
Cross-References:
* CVE-2025-22150
* CVE-2025-23166
* CVE-2025-23167
* CVE-2025-55131
* CVE-2025-59465
* CVE-2025-59466
* CVE-2025-62408
* CVE-2026-11525
* CVE-2026-12151
* CVE-2026-15157
* CVE-2026-16728
* CVE-2026-16729
* CVE-2026-21637
* CVE-2026-21710
* CVE-2026-21713
* CVE-2026-21714
* CVE-2026-21717
* CVE-2026-22036
* CVE-2026-27135
* CVE-2026-48618
* CVE-2026-48619
* CVE-2026-48928
* CVE-2026-48930
* CVE-2026-48931
* CVE-2026-48933
* CVE-2026-48934
* CVE-2026-48935
* CVE-2026-48937
* CVE-2026-56846
* CVE-2026-56848
* CVE-2026-56850
* CVE-2026-58040
* CVE-2026-58042
* CVE-2026-58043
* CVE-2026-58044
* CVE-2026-58045
* CVE-2026-6733
* CVE-2026-9679
CVSS scores:
* CVE-2025-22150 ( SUSE ): 7.4
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-22150 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2025-22150 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2025-23166 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-23166 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-23166 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-23167 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-23167 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-23167 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-55131 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-55131 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-55131 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
* CVE-2025-55131 ( NVD ): 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
* CVE-2025-59465 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-59465 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-59465 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-59465 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-59466 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-59466 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-59466 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-59466 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-62408 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-62408 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-11525 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-11525 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-12151 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-12151 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-12151 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-15157 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-15157 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-15157 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-15157 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-16728 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-16728 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-16728 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
* CVE-2026-16729 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-16729 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-16729 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-21637 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-21637 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-21637 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21637 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21710 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-21710 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21710 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21710 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21713 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-21713 ( SUSE ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-21713 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-21714 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-21714 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21714 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-21717 ( SUSE ): 7.2
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-21717 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-21717 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21717 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-22036 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-22036 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-22036 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-22036 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27135 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27135 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27135 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27135 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48618 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48618 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-48618 ( NVD ): 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
* CVE-2026-48618 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-48618 ( NVD ): 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
* CVE-2026-48619 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48619 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48619 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-48928 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48928 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
* CVE-2026-48928 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-48928 ( NVD ): 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-48930 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48930 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-48930 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-48930 ( NVD ): 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-48931 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48931 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-48931 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-48931 ( NVD ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-48933 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-48933 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48933 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48934 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48934 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-48934 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-48935 ( SUSE ): 5.1
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-48935 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-48935 ( NVD ): 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-48937 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-48937 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48937 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-56846 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56846 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56846 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56848 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56848 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56848 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56850 ( SUSE ): 5.6
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-56850 ( SUSE ): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-56850 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-56850 ( NVD ): 4.1 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-58040 ( SUSE ): 7.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
* CVE-2026-58040 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
* CVE-2026-58040 ( NVD ): 6.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
* CVE-2026-58042 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-58042 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-58042 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-58043 ( SUSE ): 8.6
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
* CVE-2026-58043 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-58043 ( NVD ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-58043 ( NVD ): 7.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-58044 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-58044 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-58044 ( NVD ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-58045 ( SUSE ): 6.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-58045 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-58045 ( NVD ): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-6733 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-6733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-9679 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-9679 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
An update that solves 38 vulnerabilities and has one security fix can now be
installed.
## Description:
This update for nodejs18 fixes the following issues:
* CVE-2025-22150: undici: insufficiently random values used when defining the
boundary for a multipart/form-data request (bsc#1236258).
* CVE-2025-23166: improper error handling in async cryptographic operations
crashes process (bsc#1243218).
* CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp
(bsc#1243220).
* CVE-2025-55131: timeout-based race conditions allow for allocations that
contain leftover data from previous operations and lead to exposure of in-
process secrets (bsc#1256570).
* CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can
cause a crash due to an unhandled error (bsc#1256573).
* CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when
`async_hooks.createHook()` is enabled can lead to crash (bsc#1256574).
* CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
* CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive
sockets can lead to incorrect response delivery (bsc#1268479).
* CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-
Cookie percent-decoding (bsc#1268477).
* CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to
incorrect parsing of Set-Cookie header (bsc#1268481).
* CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory
growth via WebSocket frames (bsc#1268482).
* CVE-2026-15157: No validation of the type property of a duck-typed blob-like
request body before using it as the Content-Type header on the HTTP/1.1
dispatcher (bsc#1272958).
* CVE-2026-16728: undici: downstream response desynchronization via retry
interceptor (bsc#1273593).
* CVE-2026-16729: undici: undici's setCookie function does not fully sanitize
cookie attributes (bsc#1273591).
* CVE-2026-21637: synchronous exceptions thrown during certain callbacks
bypass the standard TLS error handling paths and can cause a denial of
service (bsc#1256576).
* CVE-2026-21710: uncaught TypeError exception can cause a denial of service
(bsc#1260455).
* CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead
to potential MAC forgery (bsc#1260463).
* CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak
(bsc#1260480).
* CVE-2026-21717: crafted request can lead to hash collisions trivially
predictable (bsc#1260494).
* CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via
Content-Encoding may lead to resource exhaustion (bsc#1256848).
* CVE-2026-27135: nghttp2: assertion failure due to missing state validation
can lead to DoS (bsc#1259853).
* CVE-2026-48618: Node.js unicode dot separator handling can lead to tls
wildcard-depth authentication bypass due to resolver and verifier hostname
normalization mismatch (bsc#1268593).
* CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-
controlled ORIGIN frames (bsc#1268618).
* CVE-2026-48928: Uppercase sni context matching can lead to mtls
authorization bypass due to case-sensitive hostname matching (bsc#1268605).
* CVE-2026-48930: Embedded-nul hostnames can lead to silent authority
rebinding due to c-string truncation in resolver bindings (bsc#1268606).
* CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in
http.Agent (bsc#1268611).
* CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote
Process Abort (bsc#1268592).
* CVE-2026-48934: TLS host identity verification bypass via session reuse with
different servername leads to unauthorized connections (bsc#1268608).
* CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the
promises API (bsc#1268609).
* CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY`
frame (bsc#1268555).
* CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits
(bsc#1272941).
* CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free
(bsc#1272942).
* CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX
certificates (bsc#1272944).
* CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification
(bsc#1272945).
* CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A
records (bsc#1272947).
* CVE-2026-58043: Permission Model path matching can over-grant filesystem
access (bsc#1272943).
* CVE-2026-58044: HTTP parser header truncation can enable request smuggling
(bsc#1272951).
* CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length
(bsc#1272948).
Changes for nodejs18:
* upgraded embedded undici to 6.28.0.
* upgraded embedded nghttp2 to 1.69.0.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-4261
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-4261
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-4261
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-4261
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-4261
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-4261
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-4261
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-4261
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-4261
## Package List:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* corepack18-18.20.8-150400.9.39.1
* openSUSE Leap 15.4 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* nodejs18-debugsource-18.20.8-150400.9.39.1
* nodejs18-devel-18.20.8-150400.9.39.1
* nodejs18-18.20.8-150400.9.39.1
* nodejs18-debuginfo-18.20.8-150400.9.39.1
* npm18-18.20.8-150400.9.39.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* nodejs18-docs-18.20.8-150400.9.39.1
## References:
* https://www.suse.com/security/cve/CVE-2025-22150.html
* https://www.suse.com/security/cve/CVE-2025-23166.html
* https://www.suse.com/security/cve/CVE-2025-23167.html
* https://www.suse.com/security/cve/CVE-2025-55131.html
* https://www.suse.com/security/cve/CVE-2025-59465.html
* https://www.suse.com/security/cve/CVE-2025-59466.html
* https://www.suse.com/security/cve/CVE-2025-62408.html
* https://www.suse.com/security/cve/CVE-2026-11525.html
* https://www.suse.com/security/cve/CVE-2026-12151.html
* https://www.suse.com/security/cve/CVE-2026-15157.html
* https://www.suse.com/security/cve/CVE-2026-16728.html
* https://www.suse.com/security/cve/CVE-2026-16729.html
* https://www.suse.com/security/cve/CVE-2026-21637.html
* https://www.suse.com/security/cve/CVE-2026-21710.html
* https://www.suse.com/security/cve/CVE-2026-21713.html
* https://www.suse.com/security/cve/CVE-2026-21714.html
* https://www.suse.com/security/cve/CVE-2026-21717.html
* https://www.suse.com/security/cve/CVE-2026-22036.html
* https://www.suse.com/security/cve/CVE-2026-27135.html
* https://www.suse.com/security/cve/CVE-2026-48618.html
* https://www.suse.com/security/cve/CVE-2026-48619.html
* https://www.suse.com/security/cve/CVE-2026-48928.html
* https://www.suse.com/security/cve/CVE-2026-48930.html
* https://www.suse.com/security/cve/CVE-2026-48931.html
* https://www.suse.com/security/cve/CVE-2026-48933.html
* https://www.suse.com/security/cve/CVE-2026-48934.html
* https://www.suse.com/security/cve/CVE-2026-48935.html
* https://www.suse.com/security/cve/CVE-2026-48937.html
* https://www.suse.com/security/cve/CVE-2026-56846.html
* https://www.suse.com/security/cve/CVE-2026-56848.html
* https://www.suse.com/security/cve/CVE-2026-56850.html
* https://www.suse.com/security/cve/CVE-2026-58040.html
* https://www.suse.com/security/cve/CVE-2026-58042.html
* https://www.suse.com/security/cve/CVE-2026-58043.html
* https://www.suse.com/security/cve/CVE-2026-58044.html
* https://www.suse.com/security/cve/CVE-2026-58045.html
* https://www.suse.com/security/cve/CVE-2026-6733.html
* https://www.suse.com/security/cve/CVE-2026-9679.html
* https://bugzilla.suse.com/show_bug.cgi?id=1236258
* https://bugzilla.suse.com/show_bug.cgi?id=1243218
* https://bugzilla.suse.com/show_bug.cgi?id=1243220
* https://bugzilla.suse.com/show_bug.cgi?id=1254738
* https://bugzilla.suse.com/show_bug.cgi?id=1256570
* https://bugzilla.suse.com/show_bug.cgi?id=1256573
* https://bugzilla.suse.com/show_bug.cgi?id=1256574
* https://bugzilla.suse.com/show_bug.cgi?id=1256576
* https://bugzilla.suse.com/show_bug.cgi?id=1256848
* https://bugzilla.suse.com/show_bug.cgi?id=1259853
* https://bugzilla.suse.com/show_bug.cgi?id=1260455
* https://bugzilla.suse.com/show_bug.cgi?id=1260463
* https://bugzilla.suse.com/show_bug.cgi?id=1260480
* https://bugzilla.suse.com/show_bug.cgi?id=1260494
* https://bugzilla.suse.com/show_bug.cgi?id=1268477
* https://bugzilla.suse.com/show_bug.cgi?id=1268479
* https://bugzilla.suse.com/show_bug.cgi?id=1268481
* https://bugzilla.suse.com/show_bug.cgi?id=1268482
* https://bugzilla.suse.com/show_bug.cgi?id=1268555
* https://bugzilla.suse.com/show_bug.cgi?id=1268592
* https://bugzilla.suse.com/show_bug.cgi?id=1268593
* https://bugzilla.suse.com/show_bug.cgi?id=1268605
* https://bugzilla.suse.com/show_bug.cgi?id=1268606
* https://bugzilla.suse.com/show_bug.cgi?id=1268608
* https://bugzilla.suse.com/show_bug.cgi?id=1268609
* https://bugzilla.suse.com/show_bug.cgi?id=1268611
* https://bugzilla.suse.com/show_bug.cgi?id=1268618
* https://bugzilla.suse.com/show_bug.cgi?id=1269825
* https://bugzilla.suse.com/show_bug.cgi?id=1272941
* https://bugzilla.suse.com/show_bug.cgi?id=1272942
* https://bugzilla.suse.com/show_bug.cgi?id=1272943
* https://bugzilla.suse.com/show_bug.cgi?id=1272944
* https://bugzilla.suse.com/show_bug.cgi?id=1272945
* https://bugzilla.suse.com/show_bug.cgi?id=1272947
* https://bugzilla.suse.com/show_bug.cgi?id=1272948
* https://bugzilla.suse.com/show_bug.cgi?id=1272951
* https://bugzilla.suse.com/show_bug.cgi?id=1272958
* https://bugzilla.suse.com/show_bug.cgi?id=1273591
* https://bugzilla.suse.com/show_bug.cgi?id=1273593
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260918/b9768ed7/attachment.htm>
More information about the sle-updates
mailing list