openSUSE 15.6 nodejs22 Important Security Update 2026-1509

This update for nodejs22 fixes the following issues: Update to version 22.22.2. * CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494). * CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462). * CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via `fs.realpathSync.native()` (bsc#1260482). * CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via `WINDOW_UPDATE` frames sent on stream 0 (bsc#1260480). * CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463). * CVE-2026-21710:

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-1509=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1509=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1509=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-2026-1509=1

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1509=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1509=1

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * npm22-22.22.2-150600.13.15.1 * nodejs22-debugsource-22.22.2-150600.13.15.1 * nodejs22-22.22.2-150600.13.15.1 * corepack22-22.22.2-150600.13.15.1 * nodejs22-devel-22.22.2-150600.13.15.1 * nodejs22-debuginfo-22.22.2-150600.13.15.1 * openSUSE Leap 15.6 (noarch) * nodejs22-docs-22.22.2-150600.13.15.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * npm22-22.22.2-150600.13.15.1 * nodejs22-debugsource-22.22.2-150600.13.15.1 * nodejs22-22.22.2-150600.13.15.1 * nodejs22-devel-22.22.2-150600.13.15.1 * nodejs22-debuginfo-22.22.2-150600.13.15.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * nodejs22-docs-22.22.2-150600.13.15.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * npm22-22.22.2-150600.13.15.1 * nodejs22-debugsource-22.22.2-150600.13.15.1 * nodejs22-22.22.2-150600.13.15.1 * Read the Full Advisory

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)

* npm22-22.22.2-150600.13.15.1

* nodejs22-debugsource-22.22.2-150600.13.15.1

* nodejs22-22.22.2-150600.13.15.1

* corepack22-22.22.2-150600.13.15.1

* nodejs22-devel-22.22.2-150600.13.15.1

* nodejs22-debuginfo-22.22.2-150600.13.15.1

* openSUSE Leap 15.6 (noarch)

* nodejs22-docs-22.22.2-150600.13.15.1

* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)

* npm22-22.22.2-150600.13.15.1

* nodejs22-debugsource-22.22.2-150600.13.15.1

* nodejs22-22.22.2-150600.13.15.1

* nodejs22-devel-22.22.2-150600.13.15.1

* nodejs22-debuginfo-22.22.2-150600.13.15.1

* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)

* nodejs22-docs-22.22.2-150600.13.15.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)

* npm22-22.22.2-150600.13.15.1

* nodejs22-debugsource-22.22.2-150600.13.15.1

* nodejs22-22.22.2-150600.13.15.1

* bsc#1256576 * bsc#1260455 * bsc#1260462 * bsc#1260463 * bsc#1260480 * bsc#1260482 * bsc#1260494 ## References: * * * * * * * * * * * * * *

*

*

*

*

*

*

*

*

*

*

*

*

*

*