{"id":"openSUSE-SU-2026:22210-1","summary":"Security update for nodejs22","details":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)\n - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)\n - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)\n - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)\n - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)\n - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","modified":"2026-11-04T17:23:22.432955577Z","published":"2026-10-30T13:44:42Z","related":["CVE-2026-105481","CVE-2026-105482","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"upstream":["CVE-2026-105481","CVE-2026-105482","CVE-2026-106069","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286261"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286561"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286563"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286564"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286565"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286566"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286567"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286570"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105481"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105482"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106069"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106072"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106073"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-106074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-111497"}],"affected":[{"package":{"name":"nodejs22","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"corepack22":"22.23.4-160000.1.1","nodejs22":"22.23.4-160000.1.1","nodejs22-devel":"22.23.4-160000.1.1","nodejs22-docs":"22.23.4-160000.1.1","npm22":"22.23.4-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22210-1.json"}}],"schema_version":"1.9.2"}