|
|
Log in / Subscribe / Register

SUSE alert SUSE-SU-2026:3520-1 (nodejs24)



From:
              SLE-SECURITY-UPDATES <null@suse.de>


To:
              sle-security-updates@lists.suse.com


Subject:
              SUSE-SU-2026:3520-1: important: Security update for nodejs24


Date:
              Thu, 06 Aug 2026 16:32:09 -0000


Message-ID:
              <178603392987.242.12860396156656408026@70aaff0f9d46>


# Security update for nodejs24

Announcement ID: SUSE-SU-2026:3520-1  
Release Date: 2026-08-06T11:31:17Z  
Rating: important  
References:

  * bsc#1269825
  * bsc#1272882
  * bsc#1272941
  * bsc#1272942
  * bsc#1272943
  * bsc#1272944
  * bsc#1272945
  * bsc#1272946
  * bsc#1272947
  * bsc#1272948
  * bsc#1272949
  * bsc#1272950
  * bsc#1272951

  
Cross-References:

  * CVE-2026-54272
  * CVE-2026-56846
  * CVE-2026-56847
  * CVE-2026-56848
  * CVE-2026-56850
  * CVE-2026-58039
  * CVE-2026-58040
  * CVE-2026-58041
  * CVE-2026-58042
  * CVE-2026-58043
  * CVE-2026-58044
  * CVE-2026-58045

  
CVSS scores:

  * CVE-2026-54272 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
  * CVE-2026-54272 ( SUSE ):  7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  * CVE-2026-54272 ( NVD ):  6.9

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-56846 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56846 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56846 ( NVD ):  7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56847 ( SUSE ):  4.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-56847 ( SUSE ):  3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-56847 ( NVD ):  3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-56848 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56848 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56848 ( NVD ):  7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56850 ( SUSE ):  5.6
    CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-56850 ( SUSE ):  4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-56850 ( NVD ):  4.1 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-58039 ( SUSE ):  4.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-58039 ( SUSE ):  3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-58039 ( NVD ):  3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-58040 ( SUSE ):  7.0
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
  * CVE-2026-58040 ( SUSE ):  6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  * CVE-2026-58040 ( NVD ):  6.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  * CVE-2026-58041 ( SUSE ):  5.9
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-58041 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
  * CVE-2026-58041 ( NVD ):  5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
  * CVE-2026-58042 ( SUSE ):  8.2
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-58042 ( SUSE ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-58042 ( NVD ):  5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-58043 ( SUSE ):  8.6
    CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
  * CVE-2026-58043 ( SUSE ):  7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-58043 ( NVD ):  7.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-58044 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-58044 ( SUSE ):  3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-58044 ( NVD ):  3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-58045 ( SUSE ):  6.9
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-58045 ( SUSE ):  6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-58045 ( NVD ):  6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  
Affected Products:

  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7
  * Web and Scripting Module 15-SP7

  
  
An update that solves 12 vulnerabilities and has one security fix can now be
installed.

## Description:

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  * CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6
    addresses allows for bypass of SSRF and trust- boundary checks
    (bsc#1272882).
  * CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits
    (bsc#1272941).
  * CVE-2026-56847: permission model allows trace events to write outside the
    `allowlist` (bsc#1272949).
  * CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free
    (bsc#1272942).
  * CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX
    certificates (bsc#1272944).
  * CVE-2026-58039: permission model allows process reports to write outside the
    `allowlist` (bsc#1272950).
  * CVE-2026-58040: HTTPS agent session reuse can skip hostname verification
    (bsc#1272945).
  * CVE-2026-58041: `node:sqlite` `SQLTagStore` iterator replay can re-execute
    writes (bsc#1272946).
  * CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A
    records (bsc#1272947).
  * CVE-2026-58043: permission model path matching can over-grant filesystem
    access (bsc#1272943).
  * CVE-2026-58044: HTTP parser header truncation can enable request smuggling
    (bsc#1272951).
  * CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray`
    length (bsc#1272948).

Other updates and bugfixes:

  * Version 24.18.0:
  * fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
  * doc: update blockList stability status to release candidate
  * fs: support caller-supplied readFile() buffers
  * http: close pre-request sockets in closeIdleConnections
  * loader: implement package maps
  * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
  * tls: add certificateCompression option
  * vfs: dispatch node:fs/promises to mounted VFS instances
  * vfs: add minimal node:vfs subsystem

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * Web and Scripting Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-3520=1

## Package List:

  * Web and Scripting Module 15-SP7 (noarch)
    * nodejs24-docs-24.18.1-150700.15.16.1
  * Web and Scripting Module 15-SP7 (aarch64 ppc64le s390x x86_64)
    * npm24-24.18.1-150700.15.16.1
    * nodejs24-24.18.1-150700.15.16.1
    * nodejs24-debugsource-24.18.1-150700.15.16.1
    * nodejs24-debuginfo-24.18.1-150700.15.16.1
    * nodejs24-devel-24.18.1-150700.15.16.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-54272.html
  * https://www.suse.com/security/cve/CVE-2026-56846.html
  * https://www.suse.com/security/cve/CVE-2026-56847.html
  * https://www.suse.com/security/cve/CVE-2026-56848.html
  * https://www.suse.com/security/cve/CVE-2026-56850.html
  * https://www.suse.com/security/cve/CVE-2026-58039.html
  * https://www.suse.com/security/cve/CVE-2026-58040.html
  * https://www.suse.com/security/cve/CVE-2026-58041.html
  * https://www.suse.com/security/cve/CVE-2026-58042.html
  * https://www.suse.com/security/cve/CVE-2026-58043.html
  * https://www.suse.com/security/cve/CVE-2026-58044.html
  * https://www.suse.com/security/cve/CVE-2026-58045.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1269825
  * https://bugzilla.suse.com/show_bug.cgi?id=1272882
  * https://bugzilla.suse.com/show_bug.cgi?id=1272941
  * https://bugzilla.suse.com/show_bug.cgi?id=1272942
  * https://bugzilla.suse.com/show_bug.cgi?id=1272943
  * https://bugzilla.suse.com/show_bug.cgi?id=1272944
  * https://bugzilla.suse.com/show_bug.cgi?id=1272945
  * https://bugzilla.suse.com/show_bug.cgi?id=1272946
  * https://bugzilla.suse.com/show_bug.cgi?id=1272947
  * https://bugzilla.suse.com/show_bug.cgi?id=1272948
  * https://bugzilla.suse.com/show_bug.cgi?id=1272949
  * https://bugzilla.suse.com/show_bug.cgi?id=1272950
  * https://bugzilla.suse.com/show_bug.cgi?id=1272951





Attachment: None (type=text/html)

(HTML attachment elided)
to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds