{"id":"SUSE-SU-2026:4957-1","summary":"Security update for nodejs22","details":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n- Update to 22.23.3:\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - deps: update Undici to 6.28.1\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","modified":"2026-11-02T17:23:10.023243683Z","published":"2026-10-30T19:12:23Z","related":["CVE-2026-105481","CVE-2026-105482","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"upstream":["CVE-2026-105481","CVE-2026-105482","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264957-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286261"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286561"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286563"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286564"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286565"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286566"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286567"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286570"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105481"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105482"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106069"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106072"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106073"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-111497"}],"affected":[{"package":{"name":"nodejs22","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"ecosystem_specific":{"binaries":[{"nodejs22":"22.23.4-150600.13.27.1","nodejs22-devel":"22.23.4-150600.13.27.1","nodejs22-docs":"22.23.4-150600.13.27.1","npm22":"22.23.4-150600.13.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4957-1.json"}},{"package":{"name":"nodejs22","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"ecosystem_specific":{"binaries":[{"nodejs22":"22.23.4-150600.13.27.1","nodejs22-devel":"22.23.4-150600.13.27.1","nodejs22-docs":"22.23.4-150600.13.27.1","npm22":"22.23.4-150600.13.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4957-1.json"}}],"schema_version":"1.9.2"}