SB2026093016 - SUSE update for nodejs16
Published: September 30, 2026 Updated: October 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-48618)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass tls wildcard-depth authentication.
The vulnerability exists due to improper input validation in TLS hostname handling when normalizing hostnames with unicode dot separators. A remote attacker can present a crafted hostname to bypass tls wildcard-depth authentication.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-6733)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause responses to be delivered to the wrong requests.
The vulnerability exists due to a time-of-check time-of-use race condition in the HTTP/1.1 client when reusing keep-alive sockets. A remote attacker can inject an unsolicited HTTP/1.1 response onto an idle socket to cause responses to be delivered to the wrong requests.
Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
3) Input validation error (CVE-ID: CVE-2026-58045)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the synchronous node:zlib APIs when processing a spoofed TypedArray byteLength. A local user can supply a crafted TypedArray value to cause a denial of service.
Repeated exploitation of this condition can crash the process.
4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58044)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform request smuggling.
The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.
The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.
5) Input validation error (CVE-ID: CVE-2026-58042)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input handling in dns.resolveAny() when processing DNS responses containing more than 256 A records. A remote attacker can send or induce such a DNS response to cause a denial of service.
Repeated triggering of this condition can abort the process.
6) Improper Certificate Validation (CVE-ID: CVE-2026-58040)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname verification.
The vulnerability exists due to improper certificate validation in the Node.js HTTPS Agent when reusing TLS sessions across identity policies. A remote attacker can trigger TLS session reuse to bypass hostname verification.
This issue was identified as an incomplete fix for CVE-2026-48934.
7) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-56850)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reuse mutual TLS client identities across requests configured with different client certificates.
The vulnerability exists due to improper connection reuse in the Node.js HTTPS Agent when reusing connections across requests configured with different PFX certificates. A remote user can cause PFX object-array key collisions to reuse mutual TLS client identities across requests configured with different client certificates.
8) Use-after-free (CVE-ID: CVE-2026-56848)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.
9) Resource exhaustion (CVE-ID: CVE-2026-56846)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.
10) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-48937)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in the HTTP/2 server API when handling invalid protocol errors after sending a GOAWAY frame. A remote attacker can continue sending data to cause a denial of service.
11) Improper Certificate Validation (CVE-ID: CVE-2026-48934)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate validation.
The vulnerability exists due to improper certificate validation in TLS host verification when reusing a session with a different servername. A remote attacker can reuse a session with a different servername to bypass certificate validation.
12) Integer overflow (CVE-ID: CVE-2026-48933)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the WebCrypto subtle.encrypt() implementation when processing input whose size is a multiple of 2 gib. A remote attacker can supply crafted input to cause a denial of service.
13) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-48931)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the HTTP response queue.
The vulnerability exists due to a time-of-check time-of-use race condition in http.Agent when accepting a response before the client has sent the request. A remote attacker can send a response early to poison the HTTP response queue.
14) Improper Null Termination (CVE-ID: CVE-2026-48930)
CWE-ID: CWE-170 - Improper Null Termination
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname-based authority checks.
The vulnerability exists due to c-string truncation in resolver bindings in TLS hostname handling when processing hostnames containing an embedded nul character. A remote attacker can present a crafted hostname to bypass hostname-based authority checks.
15) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-48928)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass mTLS authorization.
The vulnerability exists due to case-sensitive hostname matching in SNI context matching when selecting contexts in multi-context mTLS setups. A remote attacker can use an uppercase hostname to bypass mTLS authorization.
16) Resource exhaustion (CVE-ID: CVE-2026-48619)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in node:http2 clients when processing attacker-controlled ORIGIN frames. A remote attacker can send an unlimited number of ORIGIN frames to cause a denial of service.
The issue can lead to an out-of-memory condition on the client.
17) Memory leak (CVE-ID: CVE-2025-23085)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak when a remote peer abruptly closes the socket without sending a GOAWAY notification. A remote attacker can force the application to leak memory and perform denial of service attack.
18) Input validation error (CVE-ID: CVE-2026-27135)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing state validation in the nghttp2 session handling logic when processing malformed frames after session termination has been initiated. A remote attacker can send specially crafted frames to cause a denial of service.
For PRIORITY_UPDATE and ALTSVC frames, the affected extension types must be explicitly enabled. Builds with assertions disabled may not crash under the same conditions.
19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-22036)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the fetch() API and undici decompress interceptor when processing HTTP responses with chained Content-Encoding values. A remote attacker can send a specially crafted response with thousands of compression steps to cause a denial of service.
20) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-21714)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause resource exhaustion.
The vulnerability exists due to a memory leak in the HTTP/2 server implementation when processing WINDOW_UPDATE frames on stream 0. A remote attacker can send WINDOW_UPDATE frames that exceed the maximum flow control window, causing the Http2Session object to remain allocated despite sending a GOAWAY frame.
The server fails to clean up the Http2Session object after connection termination, leading to unbounded memory consumption.
21) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-21713)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially forge message authentication codes.
The vulnerability exists due to use of non-constant-time comparison in HMAC verification in crypto_hmac.cc when validating user-provided signatures. A remote attacker can measure timing differences during signature comparison to infer valid HMAC values, acting as a timing oracle.
Exploitation requires high-resolution timing measurements and repeated queries under a favorable threat model.
22) Improper error handling (CVE-ID: CVE-2026-21710)
CWE-ID: CWE-388 - Error Handling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of special property names in HTTP headers in req.headersDistinct when parsing incoming HTTP requests. A remote attacker can send a request with a header named __proto__ to trigger a TypeError when the application accesses req.headersDistinct, crashing the Node.js process.
The exception occurs synchronously in a property getter and cannot be caught without wrapping every access in try/catch.
23) Path manipulation (CVE-ID: CVE-2026-21637)
CWE-ID: CWE-249 - DEPRECATED: Often Misused: Path Manipulation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in _tls_wrap.js when processing TLS SNI handshake requests. A remote attacker can send a specially crafted request with unexpected servername input to cause an uncaught exception, crashing the Node.js process.
Exploitation occurs during TLS handshake when SNICallback is configured and throws synchronously.
24) CRLF injection (CVE-ID: CVE-2026-15157)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerability exists due to improper neutralization of CRLF sequences in lib/dispatcher/client-h1.js when processing a duck-typed blob-like body with an untrusted .type property through the HTTP/1.1 dispatcher. A remote attacker can supply crafted CRLF sequences in the .type value to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
User interaction is required because exploitation occurs when an application passes untrusted input into a blob-like body's .type property. Native Blob is not affected, and fetch() is unaffected.
25) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12151)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.
Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.
26) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-11525)
CWE-ID: CWE-183 - Permissive List of Allowed Inputs
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken SameSite cookie policy enforcement.
The vulnerability exists due to permissive list of allowed inputs in the Set-Cookie header parser when parsing Set-Cookie headers from server responses. A remote attacker can send a specially crafted Set-Cookie header to weaken SameSite cookie policy enforcement.
The issue affects applications that forward or rely on the parsed sameSite attribute from server responses.
27) Uncaught Exception (CVE-ID: CVE-2025-59466)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in async_hooks error handling when deep recursion occurs with async_hooks.createHook() enabled. A remote attacker can trigger deep recursion to cause a denial of service.
Applications using AsyncLocalStorage or async_hooks.createHook() are affected under specific conditions.
28) Uncaught Exception (CVE-ID: CVE-2025-59465)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in the HTTP/2 server when receiving a malformed HEADERS frame with oversized invalid HPACK data. A remote attacker can send a specially crafted HTTP/2 HEADERS frame to cause a denial of service.
This primarily affects applications that do not attach explicit error handlers to secure sockets.
29) Race condition (CVE-ID: CVE-2025-55131)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or corrupt data.
The vulnerability exists due to a race condition in buffer allocation logic when using the vm module with the timeout option. A remote user can influence workload and timeout behavior to disclose sensitive information or corrupt data.
Exploitation typically requires precise timing or in-process code execution.
30) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-23167)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP/1 headers in llhttp. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
31) Improper error handling (CVE-ID: CVE-2025-23166)
CWE-ID: CWE-388 - Error Handling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect error handling in async cryptographic operations within the SignTraits::DeriveBits() function. A remote attacker can send specially crafted input to the application can crash the Node.js runtime.
Remediation
Install update from vendor's website.