Описание
Security update for nodejs20
This update for nodejs20 fixes the following issues:
- CVE-2025-22150: undici: predictable random values used when defining the boundary for a
multipart/form-datarequest (bsc#1236258). - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
- CVE-2026-9496: pacote: excessive CPU consumption in
addGitShawhen processing a specially craftedspec.rawSpecvalue can lead to DoS (bsc#1266318). - CVE-2026-9679: undici: HTTP header injection via
Set-Cookiepercent-decoding (bsc#1268477). - CVE-2026-11525: undici: weakening of cookie
SameSitepolicy due to incorrect parsing ofSet-Cookieheader (bsc#1268481). - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
- CVE-2026-16729: undici:
setCookiefunction does not fully sanitize cookie attributes (bsc#1273591). - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via
Content-Encodingmay lead to resource exhaustion (bsc#1256848). - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
- CVE-2026-40170: ngtcp2: qlog
parameters_setstack buffer overflow (bsc#1262274). - CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
- CVE-2026-48615: proxy credentials leaked in
ERR_PROXY_TUNNELerror message (bsc#1268598). - CVE-2026-48617: permission model enforcement bypass via
process.report.writeReport()path misvalidation (bsc#1268554). - CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
- CVE-2026-48619: unbounded memory growth in
node:http2clients via attacker-controlledORIGINframes (bsc#1268618). - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
- CVE-2026-48930:
embedded-nulhostnames can lead to silent authority rebinding due toc-stringtruncation in resolver bindings (bsc#1268606). - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in
http.Agent(bsc#1268611). - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
- CVE-2026-48935: permission model bypass via
FileHandle.utimes()in thepromisesAPI (bsc#1268609). - CVE-2026-48937: servers keep accepting data even after sending a
GOAWAYframe (bsc#1268555). - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
- CVE-2026-56846: HTTP/2 retained headers can bypass
maxSessionMemorylimits (bsc#1272941). - CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
- CVE-2026-58042:
dns.resolveAny()can abort on DNS responses with manyArecords (bsc#1272947). - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
- CVE-2026-58045:
node:zlibsync APIs can crash on spoofedTypedArraylength (bsc#1272948). - CVE-2026-69192: ip-address:
Address4decodes leading-zero octets as decimal while resolvers decode them as octal, which allows for SSRF and trust-boundary bypass (bsc#1277587).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:3930-1
- E-Mail link for SUSE-SU-2026:3930-1
- SUSE Security Ratings
- SUSE Bug 1236258
- SUSE Bug 1256848
- SUSE Bug 1259853
- SUSE Bug 1262274
- SUSE Bug 1266318
- SUSE Bug 1268097
- SUSE Bug 1268477
- SUSE Bug 1268479
- SUSE Bug 1268481
- SUSE Bug 1268482
- SUSE Bug 1268554
- SUSE Bug 1268555
- SUSE Bug 1268592
- SUSE Bug 1268593
- SUSE Bug 1268598
- SUSE Bug 1268605
- SUSE Bug 1268606
Описание
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
Затронутые продукты
Ссылки
- CVE-2025-22150
- SUSE Bug 1236257
Описание
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Затронутые продукты
Ссылки
- CVE-2026-11525
- SUSE Bug 1268481
Описание
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Затронутые продукты
Ссылки
- CVE-2026-12151
- SUSE Bug 1268482
Описание
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
Затронутые продукты
Ссылки
- CVE-2026-16728
- SUSE Bug 1273261
Описание
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
Затронутые продукты
Ссылки
- CVE-2026-16729
- SUSE Bug 1273262
Описание
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
Затронутые продукты
Ссылки
- CVE-2026-22036
- SUSE Bug 1256843
Описание
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27135
- SUSE Bug 1259835
Описание
ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.
Затронутые продукты
Ссылки
- CVE-2026-40170
- SUSE Bug 1262273
Описание
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Затронутые продукты
Ссылки
- CVE-2026-42338
- SUSE Bug 1268097
Описание
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48615
- SUSE Bug 1268598
Описание
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48617
- SUSE Bug 1268554
Описание
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48618
- SUSE Bug 1268593
Описание
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48619
- SUSE Bug 1268618
Описание
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48928
- SUSE Bug 1268605
Описание
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48930
- SUSE Bug 1268606
Описание
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48931
- SUSE Bug 1268611
Описание
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48933
- SUSE Bug 1268592
Описание
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48934
- SUSE Bug 1268608
- SUSE Bug 1272945
Описание
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-48935
- SUSE Bug 1268609
Описание
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
Затронутые продукты
Ссылки
- CVE-2026-48937
- SUSE Bug 1268555
Описание
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 ... labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.
Затронутые продукты
Ссылки
- CVE-2026-54272
- SUSE Bug 1272881
Описание
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56846
- SUSE Bug 1272941
Описание
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-56847
- SUSE Bug 1272949
Описание
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56848
- SUSE Bug 1272942
Описание
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-56850
- SUSE Bug 1272944
Описание
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58039
- SUSE Bug 1272950
Описание
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58040
- SUSE Bug 1272945
Описание
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Затронутые продукты
Ссылки
- CVE-2026-58042
- SUSE Bug 1272947
Описание
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58043
- SUSE Bug 1272943
Описание
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Затронутые продукты
Ссылки
- CVE-2026-58044
- SUSE Bug 1272951
Описание
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Затронутые продукты
Ссылки
- CVE-2026-58045
- SUSE Bug 1272948
Описание
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Затронутые продукты
Ссылки
- CVE-2026-6733
- SUSE Bug 1268479
Описание
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.
Затронутые продукты
Ссылки
- CVE-2026-69192
- SUSE Bug 1273556
- SUSE Bug 1277587
Описание
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
Затронутые продукты
Ссылки
- CVE-2026-9496
- SUSE Bug 1266318
Описание
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.
Затронутые продукты
Ссылки
- CVE-2026-9679
- SUSE Bug 1268477