SUSE-SU-2026:5036-1: Security update for nodejs22
This update for nodejs22 fixes the following issues:
- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565). - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561). - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563). - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566). - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570). - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567). - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).
Changes for nodejs22:
- Update to 22.23.4: - deps: update c-ares to 1.34.9 - deps: update timezone to 2026e - deps: upgrade openssl sources to openssl-3.5.9 - deps: update sqlite to 3.53.4 - deps: update undici to 6.29.1 - Update to 22.23.3: - deps: update corepack to 0.36.0 - deps: upgrade npm to 10.9.9 - deps: update icu to 78.3 - deps: update Undici to 6.28.1 - node-api: support SharedArrayBuffer in napicreatetypedarray - node-api: add napicreateexternalsharedarraybuffer
Other sources
This update for nodejs22 fixes the following issues: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565). CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561). CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563). CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566). CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570). CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567). CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564). Changes for nodejs22: Update to 22.23.4: deps: update c-ares to 1.34.9 deps: update timezone to 2026e deps: upgrade openssl sources to openssl-3.5.9 deps: update sqlite to 3.53.4 deps: update undici to 6.29.1 Update to 22.23.3: deps: update corepack to 0.36.0 deps: upgrade npm to 10.9.9 deps: update icu to 78.3 deps: update Undici to 6.28.1 node-api: support SharedArrayBuffer in napicreatetypedarray node-api: add napicreateexternalsharedarraybuffer
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/nodejs22to a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
suse/nodejs22-debugsourceto a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
suse/nodejs22-debuginfoto a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
suse/nodejs22-develto a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
suse/npm22to a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
suse/nodejs22-docsto a version that resolves this vulnerability.Fixed in 22.23.4-150700.3.21.1 - Upgrade
Upgrade
nodejs22to a version that resolves this vulnerability.Fixed in 22.23.4Patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-5036
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for this update?
Systems running the nodejs22 packages from SUSE Web and Scripting Module 15-SP7 should be prioritized. The affected package set includes nodejs22, npm22, and associated development, documentation, debug, and debugsource packages across aarch64, ppc64le, s390x, and x86_64.
Which issue has the most severe stated impact?
CVE-2026-111497 is described as a Node.js Brotli decoder out-of-bounds write that permits remote code execution. The advisory does not state the specific application conditions required to reach the vulnerable decoder.
Are TLS hostname and certificate-validation behaviors affected?
Yes. The update fixes a TLS certificate hostname bypass when a host loosely resolves to an IP address, and improper certificate validation for non-canonical IPv4 hostnames that can allow DNS SANs to authenticate IP endpoints.
What Node.js version does this update provide?
The update includes Node.js 22.23.4. It also includes dependency updates such as OpenSSL 3.5.9, c-ares 1.34.9, SQLite 3.53.4, timezone data 2026e, and undici 6.29.1.