RHSA-2026:35841
Vulnerability from csaf_opensuse - Published: 2026-07-06 00:00 - Updated: 2026-09-16 18:34Summary
security update for nodejs24
Severity
Important
Notes
Title of the patch: security update for nodejs24
Description of the patch: This security update provides a functional equivalent of RHSA-2026:35841.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:35841.
Patchnames: RHSA-2026:35841
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch | — |
Vendor Fix
|
Threats
Impact
low
5.9 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
important
7.4 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
4 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
low
8.8 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
moderate
Affected products
Recommended
6 products, the same list as for
CVE-2026-11525
Threats
Impact
important
References
48 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for nodejs24",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2026:35841.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:35841.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2026:35841",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_35841.json"
},
{
"category": "self",
"summary": "URL for RHSA-2026:35841",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/006870.html"
},
{
"category": "self",
"summary": "E-Mail link for RHSA-2026:35841",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/006870.html"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-11525 page",
"url": "https://www.suse.com/security/cve/CVE-2026-11525/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12151 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12151/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42338 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48615 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48615/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48618 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48618/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48619 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48619/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48928 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48928/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48930 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48930/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48933 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48933/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48934 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48934/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48935 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48935/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-6733 page",
"url": "https://www.suse.com/security/cve/CVE-2026-6733/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-6734 page",
"url": "https://www.suse.com/security/cve/CVE-2026-6734/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9678 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9678/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9697 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9697/"
}
],
"title": "security update for nodejs24",
"tracking": {
"current_release_date": "2026-09-16T18:34:59Z",
"generator": {
"date": "2026-07-06T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2026:35841",
"initial_release_date": "2026-07-06T00:00:00Z",
"revision_history": [
{
"date": "2026-07-06T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T17:54:36Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T18:34:59Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"product": {
"name": "nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"product_id": "nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nodejs:node.js:1:24.18.0:*:*:*:-:*:*:*",
"purl": "pkg:rpm/suse/nodejs24-docs@24.18.0-1.el10_2?arch=noarch\u0026epoch=1\u0026upstream=nodejs24-1:24.18.0-1.el10_2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch",
"product": {
"name": "nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch",
"product_id": "nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs24-npm@11.16.0-1.24.18.0.1.el10_2?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.18.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-1:24.18.0-1.el10_2.x86_64",
"product_id": "nodejs24-1:24.18.0-1.el10_2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nodejs:node.js:1:24.18.0:*:*:*:-:*:*:*",
"purl": "pkg:rpm/suse/nodejs24@24.18.0-1.el10_2?arch=x86_64\u0026epoch=1\u0026upstream=nodejs24-1:24.18.0-1.el10_2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"product_id": "nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nodejs:node.js:1:24.18.0:*:*:*:-:*:*:*",
"purl": "pkg:rpm/suse/nodejs24-devel@24.18.0-1.el10_2?arch=x86_64\u0026epoch=1\u0026upstream=nodejs24-1:24.18.0-1.el10_2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"product_id": "nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs24-full-i18n@24.18.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"product_id": "nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs24-libs@24.18.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 10",
"product": {
"name": "SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:10"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.18.0-1.el10_2.x86_64 as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-1:24.18.0-1.el10_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-1:24.18.0-1.el10_2.x86_64 as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-1:24.18.0-1.el10_2.noarch as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch"
},
"product_reference": "nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64 as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-1:24.18.0-1.el10_2.x86_64 as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
},
"product_reference": "nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 10"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-11525",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-11525"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici\u0027s fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer\u0027s view of a cookie\u0027s SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nAfter parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of \u0027Strict\u0027, \u0027Lax\u0027, or \u0027None\u0027 (exact, case-insensitive) before forwarding or relying on it.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-11525",
"url": "https://www.suse.com/security/cve/CVE-2026-11525"
},
{
"category": "external",
"summary": "SUSE Bug 1268481 for CVE-2026-11525",
"url": "https://bugzilla.suse.com/1268481"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2026-11525"
},
{
"cve": "CVE-2026-12151",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12151"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches: Upgrade to undici \u003e= 6.26.0, \u003e= 7.28.0, or \u003e= 8.5.0. Workarounds:\nNo workaround is available. The fix must be applied through an upgrade.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12151",
"url": "https://www.suse.com/security/cve/CVE-2026-12151"
},
{
"category": "external",
"summary": "SUSE Bug 1268482 for CVE-2026-12151",
"url": "https://bugzilla.suse.com/1268482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-12151"
},
{
"cve": "CVE-2026-42338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42338"
}
],
"notes": [
{
"category": "general",
"text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error\u0027s parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42338",
"url": "https://www.suse.com/security/cve/CVE-2026-42338"
},
{
"category": "external",
"summary": "SUSE Bug 1268097 for CVE-2026-42338",
"url": "https://bugzilla.suse.com/1268097"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42338"
},
{
"cve": "CVE-2026-48615",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48615"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\r\n\r\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48615",
"url": "https://www.suse.com/security/cve/CVE-2026-48615"
},
{
"category": "external",
"summary": "SUSE Bug 1268598 for CVE-2026-48615",
"url": "https://bugzilla.suse.com/1268598"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48615"
},
{
"cve": "CVE-2026-48618",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48618"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48618",
"url": "https://www.suse.com/security/cve/CVE-2026-48618"
},
{
"category": "external",
"summary": "SUSE Bug 1268593 for CVE-2026-48618",
"url": "https://bugzilla.suse.com/1268593"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48618"
},
{
"cve": "CVE-2026-48619",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48619"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48619",
"url": "https://www.suse.com/security/cve/CVE-2026-48619"
},
{
"category": "external",
"summary": "SUSE Bug 1268618 for CVE-2026-48619",
"url": "https://bugzilla.suse.com/1268618"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48619"
},
{
"cve": "CVE-2026-48928",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48928"
}
],
"notes": [
{
"category": "general",
"text": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48928",
"url": "https://www.suse.com/security/cve/CVE-2026-48928"
},
{
"category": "external",
"summary": "SUSE Bug 1268605 for CVE-2026-48928",
"url": "https://bugzilla.suse.com/1268605"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48928"
},
{
"cve": "CVE-2026-48930",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48930"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48930",
"url": "https://www.suse.com/security/cve/CVE-2026-48930"
},
{
"category": "external",
"summary": "SUSE Bug 1268606 for CVE-2026-48930",
"url": "https://bugzilla.suse.com/1268606"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48930"
},
{
"cve": "CVE-2026-48933",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48933"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48933",
"url": "https://www.suse.com/security/cve/CVE-2026-48933"
},
{
"category": "external",
"summary": "SUSE Bug 1268592 for CVE-2026-48933",
"url": "https://bugzilla.suse.com/1268592"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48933"
},
{
"cve": "CVE-2026-48934",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48934"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48934",
"url": "https://www.suse.com/security/cve/CVE-2026-48934"
},
{
"category": "external",
"summary": "SUSE Bug 1268608 for CVE-2026-48934",
"url": "https://bugzilla.suse.com/1268608"
},
{
"category": "external",
"summary": "SUSE Bug 1272945 for CVE-2026-48934",
"url": "https://bugzilla.suse.com/1272945"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48934"
},
{
"cve": "CVE-2026-48935",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48935"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48935",
"url": "https://www.suse.com/security/cve/CVE-2026-48935"
},
{
"category": "external",
"summary": "SUSE Bug 1268609 for CVE-2026-48935",
"url": "https://bugzilla.suse.com/1268609"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48935"
},
{
"cve": "CVE-2026-6733",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-6733"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nUndici\u0027s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nDisable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-6733",
"url": "https://www.suse.com/security/cve/CVE-2026-6733"
},
{
"category": "external",
"summary": "SUSE Bug 1268479 for CVE-2026-6733",
"url": "https://bugzilla.suse.com/1268479"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2026-6733"
},
{
"cve": "CVE-2026-6734",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-6734"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nWhen using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool\u0027s origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.\n\nThis causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.\n\nImpacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.\n\nThis was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.\n\nPatches:\nUpgrade to undici v7.26.0 or v8.2.0.\n\nWorkarounds:\nUse a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-6734",
"url": "https://www.suse.com/security/cve/CVE-2026-6734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-6734"
},
{
"cve": "CVE-2026-9678",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9678"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nUndici\u0027s cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=\" authorization\" or no-cache=\"\\tauthorization\". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user\u0027s authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.\n\nAffected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.\n\nPatches:\nUpgrade to undici v7.28.0 or v8.5.0.\n\nWorkarounds:\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9678",
"url": "https://www.suse.com/security/cve/CVE-2026-9678"
},
{
"category": "external",
"summary": "SUSE Bug 1268478 for CVE-2026-9678",
"url": "https://bugzilla.suse.com/1268478"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-9678"
},
{
"cve": "CVE-2026-9697",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9697"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nundici\u0027s ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node\u0027s default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.\n\nApplications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.\n\nAffected applications are those that use undici\u0027s ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.\n\nPatches:\nUpgrade to undici v7.28.0 or v8.5.0.\n\nWorkarounds:\nNo workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9697",
"url": "https://www.suse.com/security/cve/CVE-2026-9697"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:nodejs24-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-devel-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-docs-1:24.18.0-1.el10_2.noarch",
"SUSE Liberty Linux 10:nodejs24-full-i18n-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-libs-1:24.18.0-1.el10_2.x86_64",
"SUSE Liberty Linux 10:nodejs24-npm-1:11.16.0-1.24.18.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-9697"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…