Detections
Analytics

openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:22210-1)

critical Nessus Plugin ID 376243

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22210-1 advisory.

 - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
 - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
 - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
 - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
 - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
 - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
 - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

 Changes for nodejs22:

 - Update to 22.23.4:
 - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
 - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
 - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
 - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
 - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
 - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
 - deps: update c-ares to 1.34.9
 - deps: update timezone to 2026e
 - deps: upgrade openssl sources to openssl-3.5.9
 - deps: update sqlite to 3.53.4
 - deps: update undici to 6.29.1
 - deps: update corepack to 0.36.0
 - deps: upgrade npm to 10.9.9
 - deps: update icu to 78.3
 - node-api: support SharedArrayBuffer in napi_create_typedarray
 - node-api: add napi_create_external_sharedarraybuffer

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected corepack22, nodejs22, nodejs22-devel and / or npm22 packages.

See Also

https://bugzilla.suse.com/1286261

https://bugzilla.suse.com/1286561

https://bugzilla.suse.com/1286563

https://bugzilla.suse.com/1286564

https://bugzilla.suse.com/1286565

https://bugzilla.suse.com/1286566

https://bugzilla.suse.com/1286567

https://bugzilla.suse.com/1286570

https://www.suse.com/security/cve/CVE-2026-105481

https://www.suse.com/security/cve/CVE-2026-105482

https://www.suse.com/security/cve/CVE-2026-106069

https://www.suse.com/security/cve/CVE-2026-106072

https://www.suse.com/security/cve/CVE-2026-106073

https://www.suse.com/security/cve/CVE-2026-106074

https://www.suse.com/security/cve/CVE-2026-111497

Plugin Details

Severity: Critical

ID: 376243

File Name: openSUSE-2026-22210-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

Percentile: 99.83

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-111497

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 9.2

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:corepack22, p-cpe:/a:novell:opensuse:nodejs22-devel, p-cpe:/a:novell:opensuse:nodejs22, p-cpe:/a:novell:opensuse:npm22

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/21/2026

CISA Known Exploited Vulnerability Due Dates: 11/10/2026

Reference Information

CVE: CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497