SUSE-SU-2026:5036-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5036-1

SUSE-SU-2026:5036-1

Summary: Security update for nodejs22

Details: This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565). - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561). - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563). - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566). - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570). - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567). - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564). Changes for nodejs22: - Update to 22.23.4: - deps: update c-ares to 1.34.9 - deps: update timezone to 2026e - deps: upgrade openssl sources to openssl-3.5.9 - deps: update sqlite to 3.53.4 - deps: update undici to 6.29.1 - Update to 22.23.3: - deps: update corepack to 0.36.0 - deps: upgrade npm to 10.9.9 - deps: update icu to 78.3 - deps: update Undici to 6.28.1 - node-api: support SharedArrayBuffer in napi_create_typedarray - node-api: add napi_create_external_sharedarraybuffer

References: https://www.suse.com/support/update/announcement/2026/suse-su-20265036-1/, https://bugzilla.suse.com/1286261, https://bugzilla.suse.com/1286561, https://bugzilla.suse.com/1286563, https://bugzilla.suse.com/1286564, https://bugzilla.suse.com/1286565, https://bugzilla.suse.com/1286566, https://bugzilla.suse.com/1286567, https://bugzilla.suse.com/1286570, https://www.suse.com/security/cve/CVE-2026-105481, https://www.suse.com/security/cve/CVE-2026-105482, https://www.suse.com/security/cve/CVE-2026-106069, https://www.suse.com/security/cve/CVE-2026-106072, https://www.suse.com/security/cve/CVE-2026-106073, https://www.suse.com/security/cve/CVE-2026-106074, https://www.suse.com/security/cve/CVE-2026-111497