SUSE-SU-2026:5037-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5037-1

SUSE-SU-2026:5037-1

Summary: Security update for nodejs24

Details: This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565). - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561). - CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562). - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563). - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566). - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570). - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567). - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564). Non security issue fixed: - 'npm install -h' output is truncated (bsc#1276224). Changes for nodejs24: - Update to 24.22.1: - crypto: update root certificates to NSS 3.131.1 - deps: update c-ares to 1.34.9 - deps: update timezone to 2026e - deps: upgrade openssl sources to openssl-3.5.9 - deps: update undici to 7.30.1 - Update to 24.22.0: - crypto: add crypto.parsePKCS12() - crypto: discover ciphers and hashes from OpenSSL providers - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs - doc: deprecate Server.prototype._listen2 in node:net - net: support sending net.BoundSocket to threads and child processes - perf_hooks: implement SlidingWindowHistogram - perf_hooks: implement qrde analysis support in Histogram - perf_hooks: implement Histogram meanCI API - perf_hooks: add CBOR export/import for histogram exchange - sqlite: add StatementSync.prototype.close() - sqlite: add StatementSync.prototype[Symbol.dispose]() - src,lib: add util.markPromiseAsHandled - util: implement util.throttle - util: implement debounce - Update to 24.21.0: - crypto: update root certificates to NSS 3.126 - crypto: support loading private keys through STORE loaders - deps: update Undici to 7.29.1 - lib,src: improve histogram implementation - net: improve performance of net.BlockList - perf_hooks: add statistical hypothesis testing to histogram - util: add non-throwing MIMEType.parse - Update to 24.20.0: - async_hooks: add using scopes to AsyncLocalStorage - buffer: add end parameter - doc: add MikeMcC399 as collaborator - lib,permission: add permission.drop - loader: implement package maps - src,permission: add --permission-audit - stream: add node:stream/iter implementation - test_runner: add context.log() and test:log event - test_runner: report entryFile in TestStream events - wasm: enable JSPI - Update to 24.19.0: - buffer: implement blob.textStream() - deps: update OpenSSL build config to support compression - doc: update blockList stability status to release candidate - doc: mark stream.compose stable - esm: add --experimental-import-text flag - fs: support caller-supplied readFile() buffers - http: add httpValidation option to configure header value validation - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive - perf_hooks: sample delay per event loop iteration - src: allow empty --experimental-config-file - stream: expose ReadableStreamTee - tls: report negotiated TLS groups - tls: add certificateCompression option

References: https://www.suse.com/support/update/announcement/2026/suse-su-20265037-1/, https://bugzilla.suse.com/1262274, https://bugzilla.suse.com/1266318, https://bugzilla.suse.com/1276224, https://bugzilla.suse.com/1286561, https://bugzilla.suse.com/1286562, https://bugzilla.suse.com/1286563, https://bugzilla.suse.com/1286564, https://bugzilla.suse.com/1286565, https://bugzilla.suse.com/1286566, https://bugzilla.suse.com/1286567, https://bugzilla.suse.com/1286570, https://www.suse.com/security/cve/CVE-2026-105481, https://www.suse.com/security/cve/CVE-2026-105482, https://www.suse.com/security/cve/CVE-2026-105483, https://www.suse.com/security/cve/CVE-2026-106069, https://www.suse.com/security/cve/CVE-2026-106072, https://www.suse.com/security/cve/CVE-2026-106073, https://www.suse.com/security/cve/CVE-2026-106074, https://www.suse.com/security/cve/CVE-2026-111497