SUSE-SU-2026:5037-1

This update for nodejs24 fixes the following issues:

Security issues fixed:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

• 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

• Update to 24.22.1:
• crypto: update root certificates to NSS 3.131.1
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update undici to 7.30.1
• Update to 24.22.0:
• crypto: add crypto.parsePKCS12()
• crypto: discover ciphers and hashes from OpenSSL providers
• crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
• doc: deprecate Server.prototype._listen2 in node:net
• net: support sending net.BoundSocket to threads and child processes
• perf_hooks: implement SlidingWindowHistogram
• perf_hooks: implement qrde analysis support in Histogram
• perf_hooks: implement Histogram meanCI API
• perf_hooks: add CBOR export/import for histogram exchange
• sqlite: add StatementSync.prototype.close()
• sqlite: add StatementSync.prototypeSymbol.dispose
• src,lib: add util.markPromiseAsHandled
• util: implement util.throttle
• util: implement debounce
• Update to 24.21.0:
• crypto: update root certificates to NSS 3.126
• crypto: support loading private keys through STORE loaders
• deps: update Undici to 7.29.1
• lib,src: improve histogram implementation
• net: improve performance of net.BlockList
• perf_hooks: add statistical hypothesis testing to histogram
• util: add non-throwing MIMEType.parse
• Update to 24.20.0:
• async_hooks: add using scopes to AsyncLocalStorage
• buffer: add end parameter
• doc: add MikeMcC399 as collaborator
• lib,permission: add permission.drop
• loader: implement package maps
• src,permission: add --permission-audit
• stream: add node:stream/iter implementation
• test_runner: add context.log() and test:log event
• test_runner: report entryFile in TestStream events
• wasm: enable JSPI
• Update to 24.19.0:
• buffer: implement blob.textStream()
• deps: update OpenSSL build config to support compression
• doc: update blockList stability status to release candidate
• doc: mark stream.compose stable
• esm: add --experimental-import-text flag
• fs: support caller-supplied readFile() buffers
• http: add httpValidation option to configure header value validation
• net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
• perf_hooks: sample delay per event loop iteration
• src: allow empty --experimental-config-file
• stream: expose ReadableStreamTee
• tls: report negotiated TLS groups
• tls: add certificateCompression option