{"schemaVersion":3,"id":"SUSE-SU-2026:22565-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for nodejs24\n\nThis update for nodejs24 fixes the following issues\n\nUpdate to version 24.18.0 (bsc#1269825).\n\nSecurity issues fixed:\n\n- CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing (bsc#1268478).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive\n  hostname matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername` leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n\nOther updates and bugfixes:\n- Version 24.18.0:\n  - doc: update `blockList` stability status to release candidate\n  - fs: support caller-supplied `readFile()` buffers\n  - http: close pre-request sockets in `closeIdleConnections`\n  - loader: implement package maps\n  - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`\n  - tls: add `certificateCompression` option\n  - vfs: dispatch `node:fs/promises` to mounted VFS instances\n  - vfs: add minimal `node:vfs` subsystem\n- For changes in older versions, see https://github.com/nodejs/node/releases.\n- Remove `update-alternatives` from scriptlets if not available.\n- Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.\n- Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.","dates":{"published":"2026-07-06T20:22:30.000Z","modified":"2026-07-15T18:24:11.411Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"nodejs24&distro=SUSE Linux Enterprise Server 16.0","name":"nodejs24","label":"nodejs24&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs24&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 24.18.0-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.18.0-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"nodejs24&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"nodejs24","label":"nodejs24&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs24&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 24.18.0-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.18.0-160000.1.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622565-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202622565-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1259853","label":"bugzilla.suse.com/1259853","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262274","label":"bugzilla.suse.com/1262274","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266318","label":"bugzilla.suse.com/1266318","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268097","label":"bugzilla.suse.com/1268097","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268477","label":"bugzilla.suse.com/1268477","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268478","label":"bugzilla.suse.com/1268478","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268479","label":"bugzilla.suse.com/1268479","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268480","label":"bugzilla.suse.com/1268480","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268481","label":"bugzilla.suse.com/1268481","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268482","label":"bugzilla.suse.com/1268482","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268554","label":"bugzilla.suse.com/1268554","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268555","label":"bugzilla.suse.com/1268555","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268592","label":"bugzilla.suse.com/1268592","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268593","label":"bugzilla.suse.com/1268593","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268598","label":"bugzilla.suse.com/1268598","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268605","label":"bugzilla.suse.com/1268605","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268606","label":"bugzilla.suse.com/1268606","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268608","label":"bugzilla.suse.com/1268608","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268609","label":"bugzilla.suse.com/1268609","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268611","label":"bugzilla.suse.com/1268611","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268618","label":"bugzilla.suse.com/1268618","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269825","label":"bugzilla.suse.com/1269825","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","label":"www.suse.com/security/cve/CVE-2026-11525","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","label":"www.suse.com/security/cve/CVE-2026-12151","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2581","label":"www.suse.com/security/cve/CVE-2026-2581","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","label":"www.suse.com/security/cve/CVE-2026-27135","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40170","label":"www.suse.com/security/cve/CVE-2026-40170","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42338","label":"www.suse.com/security/cve/CVE-2026-42338","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","label":"www.suse.com/security/cve/CVE-2026-48615","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","label":"www.suse.com/security/cve/CVE-2026-48617","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","label":"www.suse.com/security/cve/CVE-2026-48618","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","label":"www.suse.com/security/cve/CVE-2026-48619","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","label":"www.suse.com/security/cve/CVE-2026-48928","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","label":"www.suse.com/security/cve/CVE-2026-48930","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","label":"www.suse.com/security/cve/CVE-2026-48931","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","label":"www.suse.com/security/cve/CVE-2026-48933","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","label":"www.suse.com/security/cve/CVE-2026-48934","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","label":"www.suse.com/security/cve/CVE-2026-48935","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","label":"www.suse.com/security/cve/CVE-2026-48937","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","label":"www.suse.com/security/cve/CVE-2026-6733","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9496","label":"www.suse.com/security/cve/CVE-2026-9496","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9678","label":"www.suse.com/security/cve/CVE-2026-9678","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","label":"www.suse.com/security/cve/CVE-2026-9679","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-11525","CVE-2026-12151","CVE-2026-2581","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9678","CVE-2026-9679"],"downstream":[],"duplicates":[],"related":["CVE-2026-11525","CVE-2026-12151","CVE-2026-2581","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9678","CVE-2026-9679"]},"timeline":[{"kind":"published","date":"2026-07-06T20:22:30.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-15T18:24:11.411Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:14:11.191Z","stale":false,"partial":false}}