SUSE-SU-2026:4957-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20264957-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4957-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:4957-1
Upstream
CVE (7)
  • CVE-2026-105481
  • CVE-2026-105482
  • CVE-2026-106069
  • CVE-2026-106072
  • CVE-2026-106073
  • CVE-2026-106074
  • CVE-2026-111497
Related
CVE (7)
  • CVE-2026-105481
  • CVE-2026-105482
  • CVE-2026-106069
  • CVE-2026-106072
  • CVE-2026-106073
  • CVE-2026-106074
  • CVE-2026-111497
Published
2026-10-30T19:12:23Z
Modified
2026-11-02T17:23:10Z
Summary
Security update for nodejs22
Details

This update for nodejs22 fixes the following issues:

  • CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
  • CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
  • CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
  • CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
  • CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
  • CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
  • CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

  • Update to 22.23.4:
  • deps: update c-ares to 1.34.9
  • deps: update timezone to 2026e
  • deps: upgrade openssl sources to openssl-3.5.9
  • deps: update sqlite to 3.53.4
  • deps: update undici to 6.29.1
  • Update to 22.23.3:
  • deps: update corepack to 0.36.0
  • deps: upgrade npm to 10.9.9
  • deps: update icu to 78.3
  • deps: update Undici to 6.28.1
  • node-api: support SharedArrayBuffer in napi_create_typedarray
  • node-api: add napi_create_external_sharedarraybuffer
References

Affected packages

SUSE:Linux Enterprise Server 15 SP6-LTSS / nodejs22

Package

Name
nodejs22
Purl
pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.4-150600.13.27.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs22": "22.23.4-150600.13.27.1",
            "nodejs22-devel": "22.23.4-150600.13.27.1",
            "nodejs22-docs": "22.23.4-150600.13.27.1",
            "npm22": "22.23.4-150600.13.27.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4957-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6 / nodejs22

Package

Name
nodejs22
Purl
pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.4-150600.13.27.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs22": "22.23.4-150600.13.27.1",
            "nodejs22-devel": "22.23.4-150600.13.27.1",
            "nodejs22-docs": "22.23.4-150600.13.27.1",
            "npm22": "22.23.4-150600.13.27.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4957-1.json"