SUSE-SU-2026:4261-1

Advisory lineage Upstream: 38 Downstream: 0
Published: 18 Sept 2026, 07:44
Last modified:18 Sept 2026, 18:00

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Sept 2026, 07:44
Published
Vulnerability first disclosed
18 Sept 2026, 18:00
Last Modified
Vulnerability information updated

Description

Security update for nodejs18 This update for nodejs18 fixes the following issues: - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258). - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218). - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220). - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570). - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573). - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can lead to crash (bsc#1256574). - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738). - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479). - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477). - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481). - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482). - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958). - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593). - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591). - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576). - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455). - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463). - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480). - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494). - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848). - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853). - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593). - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618). - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605). - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606). - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611). - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592). - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608). - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609). - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555). - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941). - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942). - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944). - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945). - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947). - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943). - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951). - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948). Changes for nodejs18: - upgraded embedded undici to 6.28.0. - upgraded embedded nghttp2 to 1.69.0.

Affected Systems

  • suse•nodejs18&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise Server 15 SP4-LTSS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4

    < 18.20.8-150400.9.39.1

  • suse•nodejs18&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

    < 18.20.8-150400.9.39.1

References (78)