{"schemaVersion":3,"id":"SUSE-SU-2026:2695-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for nodejs22\n\nThis update for nodejs22 fixes the following issues:\n\n- CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).\n- CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).\n- CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).\n- CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).\n- CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).\n- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).\n- CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).\n- CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).\n- CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).\n- CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).\n- CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).\n- CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).\n- CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` ( bsc#1266318).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).","dates":{"published":"2026-06-30T09:06:44.000Z","modified":"2026-07-01T09:45:06.071Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"nodejs22&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","name":"nodejs22","label":"nodejs22&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs22&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","purlType":"rpm","versions":[{"text":"< 22.23.0-150700.3.12.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.23.0-150700.3.12.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262695-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262695-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1259853","label":"bugzilla.suse.com/1259853","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262274","label":"bugzilla.suse.com/1262274","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266318","label":"bugzilla.suse.com/1266318","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268097","label":"bugzilla.suse.com/1268097","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268477","label":"bugzilla.suse.com/1268477","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268479","label":"bugzilla.suse.com/1268479","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268481","label":"bugzilla.suse.com/1268481","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268482","label":"bugzilla.suse.com/1268482","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268554","label":"bugzilla.suse.com/1268554","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268555","label":"bugzilla.suse.com/1268555","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268592","label":"bugzilla.suse.com/1268592","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268593","label":"bugzilla.suse.com/1268593","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268598","label":"bugzilla.suse.com/1268598","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268605","label":"bugzilla.suse.com/1268605","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268606","label":"bugzilla.suse.com/1268606","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268608","label":"bugzilla.suse.com/1268608","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268609","label":"bugzilla.suse.com/1268609","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268611","label":"bugzilla.suse.com/1268611","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268618","label":"bugzilla.suse.com/1268618","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","label":"www.suse.com/security/cve/CVE-2026-11525","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","label":"www.suse.com/security/cve/CVE-2026-12151","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","label":"www.suse.com/security/cve/CVE-2026-27135","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40170","label":"www.suse.com/security/cve/CVE-2026-40170","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42338","label":"www.suse.com/security/cve/CVE-2026-42338","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","label":"www.suse.com/security/cve/CVE-2026-48615","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","label":"www.suse.com/security/cve/CVE-2026-48617","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","label":"www.suse.com/security/cve/CVE-2026-48618","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","label":"www.suse.com/security/cve/CVE-2026-48619","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","label":"www.suse.com/security/cve/CVE-2026-48928","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","label":"www.suse.com/security/cve/CVE-2026-48930","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","label":"www.suse.com/security/cve/CVE-2026-48931","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","label":"www.suse.com/security/cve/CVE-2026-48933","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","label":"www.suse.com/security/cve/CVE-2026-48934","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","label":"www.suse.com/security/cve/CVE-2026-48935","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","label":"www.suse.com/security/cve/CVE-2026-48937","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","label":"www.suse.com/security/cve/CVE-2026-6733","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9496","label":"www.suse.com/security/cve/CVE-2026-9496","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","label":"www.suse.com/security/cve/CVE-2026-9679","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-11525","CVE-2026-12151","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9679"],"downstream":[],"duplicates":[],"related":["CVE-2026-11525","CVE-2026-12151","CVE-2026-27135","CVE-2026-40170","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-6733","CVE-2026-9496","CVE-2026-9679"]},"timeline":[{"kind":"published","date":"2026-06-30T09:06:44.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-01T09:45:06.071Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T03:07:10.114Z","stale":false,"partial":false}}