SUSE-SU-2026:2647-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20262647-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2647-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:2647-1
Upstream
CVE (19)
Related
CVE (19)
Published
2026-06-26T10:34:05Z
Modified
2026-06-27T08:45:06Z
Summary
Security update for nodejs22
Details

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
References

Affected packages

SUSE:Linux Enterprise Server 15 SP6-LTSS / nodejs22

Package

Name
nodejs22
Purl
pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.0-150600.13.18.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs22":  "22.23.0-150600.13.18.1",
            "nodejs22-devel":  "22.23.0-150600.13.18.1",
            "nodejs22-docs":  "22.23.0-150600.13.18.1",
            "npm22":  "22.23.0-150600.13.18.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2647-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6 / nodejs22

Package

Name
nodejs22
Purl
pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.0-150600.13.18.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs22":  "22.23.0-150600.13.18.1",
            "nodejs22-devel":  "22.23.0-150600.13.18.1",
            "nodejs22-docs":  "22.23.0-150600.13.18.1",
            "npm22":  "22.23.0-150600.13.18.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2647-1.json"