{"schemaVersion":3,"id":"SUSE-SU-2026:4355-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for nodejs16\n\nThis update for nodejs16 fixes the following issues:\n\n- CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).","dates":{"published":"2026-09-28T08:55:58.000Z","modified":"2026-09-29T09:15:07.942Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"nodejs16","label":"nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 16.20.2-150400.3.42.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 16.20.2-150400.3.42.1","eol":null,"hubHref":null},{"vendor":"suse","product":"nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"nodejs16","label":"nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs16&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 16.20.2-150400.3.42.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 16.20.2-150400.3.42.1","eol":null,"hubHref":null},{"vendor":"suse","product":"nodejs16&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"nodejs16","label":"nodejs16&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs16&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 16.20.2-150400.3.42.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 16.20.2-150400.3.42.1","eol":null,"hubHref":null},{"vendor":"suse","product":"nodejs16&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"nodejs16","label":"nodejs16&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/nodejs16&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 16.20.2-150400.3.42.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 16.20.2-150400.3.42.1","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264355-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20264355-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1236250","label":"bugzilla.suse.com/1236250","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1243218","label":"bugzilla.suse.com/1243218","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1243220","label":"bugzilla.suse.com/1243220","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256570","label":"bugzilla.suse.com/1256570","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256573","label":"bugzilla.suse.com/1256573","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256574","label":"bugzilla.suse.com/1256574","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256576","label":"bugzilla.suse.com/1256576","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256848","label":"bugzilla.suse.com/1256848","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259853","label":"bugzilla.suse.com/1259853","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1260455","label":"bugzilla.suse.com/1260455","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1260463","label":"bugzilla.suse.com/1260463","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1260480","label":"bugzilla.suse.com/1260480","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268479","label":"bugzilla.suse.com/1268479","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268481","label":"bugzilla.suse.com/1268481","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268482","label":"bugzilla.suse.com/1268482","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268555","label":"bugzilla.suse.com/1268555","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268592","label":"bugzilla.suse.com/1268592","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268593","label":"bugzilla.suse.com/1268593","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268605","label":"bugzilla.suse.com/1268605","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268606","label":"bugzilla.suse.com/1268606","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268608","label":"bugzilla.suse.com/1268608","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268611","label":"bugzilla.suse.com/1268611","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268618","label":"bugzilla.suse.com/1268618","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269825","label":"bugzilla.suse.com/1269825","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272941","label":"bugzilla.suse.com/1272941","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272942","label":"bugzilla.suse.com/1272942","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272944","label":"bugzilla.suse.com/1272944","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272945","label":"bugzilla.suse.com/1272945","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272947","label":"bugzilla.suse.com/1272947","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272948","label":"bugzilla.suse.com/1272948","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272951","label":"bugzilla.suse.com/1272951","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272958","label":"bugzilla.suse.com/1272958","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","label":"www.suse.com/security/cve/CVE-2025-23085","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","label":"www.suse.com/security/cve/CVE-2025-23166","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","label":"www.suse.com/security/cve/CVE-2025-23167","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","label":"www.suse.com/security/cve/CVE-2025-55131","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","label":"www.suse.com/security/cve/CVE-2025-59465","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","label":"www.suse.com/security/cve/CVE-2025-59466","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","label":"www.suse.com/security/cve/CVE-2026-11525","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","label":"www.suse.com/security/cve/CVE-2026-12151","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","label":"www.suse.com/security/cve/CVE-2026-15157","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","label":"www.suse.com/security/cve/CVE-2026-21637","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","label":"www.suse.com/security/cve/CVE-2026-21710","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","label":"www.suse.com/security/cve/CVE-2026-21713","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","label":"www.suse.com/security/cve/CVE-2026-21714","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","label":"www.suse.com/security/cve/CVE-2026-22036","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","label":"www.suse.com/security/cve/CVE-2026-27135","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","label":"www.suse.com/security/cve/CVE-2026-48618","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","label":"www.suse.com/security/cve/CVE-2026-48619","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","label":"www.suse.com/security/cve/CVE-2026-48928","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","label":"www.suse.com/security/cve/CVE-2026-48930","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","label":"www.suse.com/security/cve/CVE-2026-48931","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","label":"www.suse.com/security/cve/CVE-2026-48933","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","label":"www.suse.com/security/cve/CVE-2026-48934","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","label":"www.suse.com/security/cve/CVE-2026-48937","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","label":"www.suse.com/security/cve/CVE-2026-56846","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","label":"www.suse.com/security/cve/CVE-2026-56848","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","label":"www.suse.com/security/cve/CVE-2026-56850","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","label":"www.suse.com/security/cve/CVE-2026-58040","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","label":"www.suse.com/security/cve/CVE-2026-58042","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","label":"www.suse.com/security/cve/CVE-2026-58044","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","label":"www.suse.com/security/cve/CVE-2026-58045","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","label":"www.suse.com/security/cve/CVE-2026-6733","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2025-23085","CVE-2025-23166","CVE-2025-23167","CVE-2025-55131","CVE-2025-59465","CVE-2025-59466","CVE-2026-11525","CVE-2026-12151","CVE-2026-15157","CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-22036","CVE-2026-27135","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48937","CVE-2026-56846","CVE-2026-56848","CVE-2026-56850","CVE-2026-58040","CVE-2026-58042","CVE-2026-58044","CVE-2026-58045","CVE-2026-6733"],"downstream":[],"duplicates":[],"related":["CVE-2025-23085","CVE-2025-23166","CVE-2025-23167","CVE-2025-55131","CVE-2025-59465","CVE-2025-59466","CVE-2026-11525","CVE-2026-12151","CVE-2026-15157","CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-22036","CVE-2026-27135","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48937","CVE-2026-56846","CVE-2026-56848","CVE-2026-56850","CVE-2026-58040","CVE-2026-58042","CVE-2026-58044","CVE-2026-58045","CVE-2026-6733"]},"timeline":[{"kind":"published","date":"2026-09-28T08:55:58.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-29T09:15:07.942Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:50:58.932Z","stale":false,"partial":false}}