< back to search

gpp_maybe Security update for nodejs22
SUSE-SLES-16.0-1079

This update for nodejs22 fixes the following issues Update to 22.23.0: - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479). - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` value can lead to DoS (bsc#1266318). - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477). - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481). - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482). - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576). - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455). - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463). - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480). - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482). - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462). - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494). - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853). - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274). - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097). - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598). - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation (bsc#1268554). - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593). - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618). - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605). - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606). - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611). - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592). - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608). - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609). - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

cloud_download Downloads

SUSE Linux Enterprise Server 16.0 x86_64
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm
SUSE Linux Enterprise Server 16.0 ppc64le
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm
SUSE Linux Enterprise Server for SAP applications 16.0 ppc64le
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm
SUSE Linux Enterprise Server for SAP applications 16.0 x86_64
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm
SUSE Linux Enterprise Server 16.0 s390x
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm
SUSE Linux Enterprise Server 16.0 aarch64
  • Packages
    corepack22
    Helper bridge between NodeJS projects and their dependencies
    22.23.0-160000.1.1 lock rpm
    nodejs22
    Evented I/O for V8 JavaScript
    22.23.0-160000.1.1 lock rpm
    nodejs22-devel
    Development headers for NodeJS 22.x
    22.23.0-160000.1.1 lock rpm
    nodejs22-docs
    Node.js API documentation
    22.23.0-160000.1.1 lock rpm
    npm22
    Package manager for Node.js
    22.23.0-160000.1.1 lock rpm