{"id":"SUSE-SU-2026:5037-1","summary":"Security update for nodejs24","details":"This update for nodejs24 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nNon security issue fixed:\n\n- 'npm install -h' output is truncated (bsc#1276224).\n\nChanges for nodejs24:\n\n- Update to 24.22.1:\n - crypto: update root certificates to NSS 3.131.1\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update undici to 7.30.1\n- Update to 24.22.0:\n - crypto: add crypto.parsePKCS12()\n - crypto: discover ciphers and hashes from OpenSSL providers\n - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs\n - doc: deprecate Server.prototype._listen2 in node:net\n - net: support sending net.BoundSocket to threads and child processes\n - perf_hooks: implement SlidingWindowHistogram\n - perf_hooks: implement qrde analysis support in Histogram\n - perf_hooks: implement Histogram meanCI API\n - perf_hooks: add CBOR export/import for histogram exchange\n - sqlite: add StatementSync.prototype.close()\n - sqlite: add StatementSync.prototype[Symbol.dispose]()\n - src,lib: add util.markPromiseAsHandled\n - util: implement util.throttle\n - util: implement debounce\n- Update to 24.21.0:\n - crypto: update root certificates to NSS 3.126\n - crypto: support loading private keys through STORE loaders\n - deps: update Undici to 7.29.1\n - lib,src: improve histogram implementation\n - net: improve performance of net.BlockList\n - perf_hooks: add statistical hypothesis testing to histogram\n - util: add non-throwing MIMEType.parse\n- Update to 24.20.0:\n - async_hooks: add using scopes to AsyncLocalStorage\n - buffer: add end parameter\n - doc: add MikeMcC399 as collaborator\n - lib,permission: add permission.drop\n - loader: implement package maps\n - src,permission: add --permission-audit\n - stream: add node:stream/iter implementation\n - test_runner: add context.log() and test:log event\n - test_runner: report entryFile in TestStream events\n - wasm: enable JSPI\n- Update to 24.19.0:\n - buffer: implement blob.textStream()\n - deps: update OpenSSL build config to support compression\n - doc: update blockList stability status to release candidate\n - doc: mark stream.compose stable\n - esm: add --experimental-import-text flag\n - fs: support caller-supplied readFile() buffers\n - http: add httpValidation option to configure header value validation\n - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive\n - perf_hooks: sample delay per event loop iteration\n - src: allow empty --experimental-config-file\n - stream: expose ReadableStreamTee\n - tls: report negotiated TLS groups\n - tls: add certificateCompression option\n","modified":"2026-11-03T13:15:07.829767078Z","published":"2026-11-02T16:21:32Z","related":["CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"upstream":["CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265037-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262274"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276224"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286561"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286562"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286563"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286564"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286565"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286566"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286567"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286570"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105481"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105482"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105483"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106069"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106072"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106073"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-111497"}],"affected":[{"package":{"name":"nodejs24","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/nodejs24&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-150700.15.21.1"}]}],"ecosystem_specific":{"binaries":[{"nodejs24-devel":"24.22.1-150700.15.21.1","nodejs24-docs":"24.22.1-150700.15.21.1","npm24":"24.22.1-150700.15.21.1","nodejs24":"24.22.1-150700.15.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5037-1.json"}}],"schema_version":"1.9.2"}