SB20260831128 - SUSE update for nodejs22
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-54272)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass SSRF and trust-boundary checks.
The vulnerability exists due to improper input validation in Address6 special-property checks when processing IPv4-mapped or NAT64 IPv6 addresses. A remote attacker can supply a crafted IPv6 literal that embeds an internal IPv4 destination to bypass SSRF and trust-boundary checks.
For NAT64 addresses, end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.
2) Resource exhaustion (CVE-ID: CVE-2026-56846)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.
3) Improper access control (CVE-ID: CVE-2026-56847)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write trace logs outside allowed filesystem paths.
The vulnerability exists due to improper access control in Node.js Permission Model enforcement when trace_events.createTracing().enable() writes trace logs. A local user can invoke trace_events.createTracing().enable() to write trace logs outside allowed filesystem paths.
This issue affects configurations that use the Permission Model with --allow-fs-write restrictions.
4) Use-after-free (CVE-ID: CVE-2026-56848)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.
5) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-56850)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reuse mutual TLS client identities across requests configured with different client certificates.
The vulnerability exists due to improper connection reuse in the Node.js HTTPS Agent when reusing connections across requests configured with different PFX certificates. A remote user can cause PFX object-array key collisions to reuse mutual TLS client identities across requests configured with different client certificates.
6) Improper access control (CVE-ID: CVE-2026-58039)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write or overwrite files outside allowed filesystem paths.
The vulnerability exists due to improper access control in Node.js Permission Model enforcement when process.report writes files. A local user can invoke process.report to write or overwrite files outside allowed filesystem paths.
This issue affects configurations that use --allow-fs-write restrictions.
7) Improper Certificate Validation (CVE-ID: CVE-2026-58040)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname verification.
The vulnerability exists due to improper certificate validation in the Node.js HTTPS Agent when reusing TLS sessions across identity policies. A remote attacker can trigger TLS session reuse to bypass hostname verification.
This issue was identified as an incomplete fix for CVE-2026-48934.
8) Input validation error (CVE-ID: CVE-2026-58042)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input handling in dns.resolveAny() when processing DNS responses containing more than 256 A records. A remote attacker can send or induce such a DNS response to cause a denial of service.
Repeated triggering of this condition can abort the process.
9) Improper access control (CVE-ID: CVE-2026-58043)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.
The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
The issue applies only when the Permission Model is enabled with --permission.
10) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58044)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform request smuggling.
The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.
The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.
11) Input validation error (CVE-ID: CVE-2026-58045)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the synchronous node:zlib APIs when processing a spoofed TypedArray byteLength. A local user can supply a crafted TypedArray value to cause a denial of service.
Repeated exploitation of this condition can crash the process.
Remediation
Install update from vendor's website.