SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:5037-1)

critical Nessus Plugin ID 376265

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5037-1 advisory.

Security issues fixed:

- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
- CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

- 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

- Update to 24.22.1:
- crypto: update root certificates to NSS 3.131.1
- deps: update c-ares to 1.34.9
- deps: update timezone to 2026e
- deps: upgrade openssl sources to openssl-3.5.9
- deps: update undici to 7.30.1
- Update to 24.22.0:
- crypto: add crypto.parsePKCS12()
- crypto: discover ciphers and hashes from OpenSSL providers
- crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
- doc: deprecate Server.prototype._listen2 in node:net
- net: support sending net.BoundSocket to threads and child processes
- perf_hooks: implement SlidingWindowHistogram
- perf_hooks: implement qrde analysis support in Histogram
- perf_hooks: implement Histogram meanCI API
- perf_hooks: add CBOR export/import for histogram exchange
- sqlite: add StatementSync.prototype.close()
- sqlite: add StatementSync.prototype[Symbol.dispose]()
- src,lib: add util.markPromiseAsHandled
- util: implement util.throttle
- util: implement debounce
- Update to 24.21.0:
- crypto: update root certificates to NSS 3.126
- crypto: support loading private keys through STORE loaders
- deps: update Undici to 7.29.1
- lib,src: improve histogram implementation
- net: improve performance of net.BlockList
- perf_hooks: add statistical hypothesis testing to histogram
- util: add non-throwing MIMEType.parse
- Update to 24.20.0:
- async_hooks: add using scopes to AsyncLocalStorage
- buffer: add end parameter
- doc: add MikeMcC399 as collaborator
- lib,permission: add permission.drop
- loader: implement package maps
- src,permission: add --permission-audit
- stream: add node:stream/iter implementation
- test_runner: add context.log() and test:log event
- test_runner: report entryFile in TestStream events
- wasm: enable JSPI
- Update to 24.19.0:
- buffer: implement blob.textStream()
- deps: update OpenSSL build config to support compression
- doc: update blockList stability status to release candidate
- doc: mark stream.compose stable
- esm: add --experimental-import-text flag
- fs: support caller-supplied readFile() buffers
- http: add httpValidation option to configure header value validation
- net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
- perf_hooks: sample delay per event loop iteration
- src: allow empty --experimental-config-file
- stream: expose ReadableStreamTee
- tls: report negotiated TLS groups
- tls: add certificateCompression option

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected nodejs24, nodejs24-devel, nodejs24-docs and / or npm24 packages.

Plugin Details

Severity: Critical

ID: 376265

File Name: suse_SU-2026-5037-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

Percentile: 99.83

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-111497

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 9.2

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:nodejs24-devel, p-cpe:/a:novell:suse_linux:nodejs24-docs, p-cpe:/a:novell:suse_linux:nodejs24, p-cpe:/a:novell:suse_linux:npm24

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/2/2026

Vulnerability Publication Date: 10/21/2026

CISA Known Exploited Vulnerability Due Dates: 11/10/2026

Reference Information

CVE: CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497

SuSE: SUSE-SU-2026:5037-1

Detections

Analytics

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:5037-1)

critical Nessus Plugin ID 376265

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information