Описание
Security update for nodejs22
This update for nodejs22 fixes the following issues:
Update to 22.23.2.
- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
- CVE-2026-56846: HTTP/2 retained headers can bypass
maxSessionMemorylimits (bsc#1272941). - CVE-2026-56847: permission model allows trace events to write outside the
allowlist(bsc#1272949). - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
- CVE-2026-58039: permission model allows process reports to write outside the
allowlist(bsc#1272950). - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
- CVE-2026-58042:
dns.resolveAny()can abort on DNS responses with many A records (bsc#1272947). - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
- CVE-2026-58045:
node:zlibsync APIs can crash on spoofedTypedArraylength (bsc#1272948).
Список пакетов
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3521-1
- E-Mail link for SUSE-SU-2026:3521-1
- SUSE Security Ratings
- SUSE Bug 1272882
- SUSE Bug 1272941
- SUSE Bug 1272942
- SUSE Bug 1272943
- SUSE Bug 1272944
- SUSE Bug 1272945
- SUSE Bug 1272947
- SUSE Bug 1272948
- SUSE Bug 1272949
- SUSE Bug 1272950
- SUSE Bug 1272951
- SUSE CVE CVE-2026-54272 page
- SUSE CVE CVE-2026-56846 page
- SUSE CVE CVE-2026-56847 page
- SUSE CVE CVE-2026-56848 page
- SUSE CVE CVE-2026-56850 page
- SUSE CVE CVE-2026-58039 page
Описание
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 ... labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.
Затронутые продукты
Ссылки
- CVE-2026-54272
- SUSE Bug 1272881
Описание
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56846
- SUSE Bug 1272941
Описание
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-56847
- SUSE Bug 1272949
Описание
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56848
- SUSE Bug 1272942
Описание
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56850
- SUSE Bug 1272944
Описание
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58039
- SUSE Bug 1272950
Описание
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58040
- SUSE Bug 1272945
Описание
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-58042
- SUSE Bug 1272947
Описание
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58043
- SUSE Bug 1272943
Описание
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-58044
- SUSE Bug 1272951
Описание
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58045
- SUSE Bug 1272948