Detections
Analytics

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:4957-1)

critical Nessus Plugin ID 375381

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4957-1 advisory.

 - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
 - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
 - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
 - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
 - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
 - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
 - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

 Changes for nodejs22:

 - Update to 22.23.4:
 - deps: update c-ares to 1.34.9
 - deps: update timezone to 2026e
 - deps: upgrade openssl sources to openssl-3.5.9
 - deps: update sqlite to 3.53.4
 - deps: update undici to 6.29.1
 - Update to 22.23.3:
 - deps: update corepack to 0.36.0
 - deps: upgrade npm to 10.9.9
 - deps: update icu to 78.3
 - deps: update Undici to 6.28.1
 - node-api: support SharedArrayBuffer in napi_create_typedarray
 - node-api: add napi_create_external_sharedarraybuffer

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected nodejs22, nodejs22-devel, nodejs22-docs and / or npm22 packages.

See Also

https://bugzilla.suse.com/1286261

https://bugzilla.suse.com/1286561

https://bugzilla.suse.com/1286563

https://bugzilla.suse.com/1286564

https://bugzilla.suse.com/1286565

https://bugzilla.suse.com/1286566

https://bugzilla.suse.com/1286567

https://bugzilla.suse.com/1286570

https://www.suse.com/security/cve/CVE-2026-105481

https://www.suse.com/security/cve/CVE-2026-105482

https://www.suse.com/security/cve/CVE-2026-106069

https://www.suse.com/security/cve/CVE-2026-106072

https://www.suse.com/security/cve/CVE-2026-106073

https://www.suse.com/security/cve/CVE-2026-106074

https://www.suse.com/security/cve/CVE-2026-111497

http://www.nessus.org/u?3d6e1d73

Plugin Details

Severity: Critical

ID: 375381

File Name: suse_SU-2026-4957-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/3/2026

Updated: 11/3/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

Percentile: 99.83

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-111497

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 9.2

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:nodejs22-devel, p-cpe:/a:novell:suse_linux:nodejs22-docs, p-cpe:/a:novell:suse_linux:nodejs22, p-cpe:/a:novell:suse_linux:npm22

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/21/2026

CISA Known Exploited Vulnerability Due Dates: 11/10/2026

Reference Information

CVE: CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497

SuSE: SUSE-SU-2026:4957-1