openSUSE Nodejs16 Important Fix for 31 Issues CVE-2025

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

This update for nodejs16 fixes the following issues:

* CVE-2025-23085: memory leak when remote peer abruptly closes socket without

sending GOAWAY notification (bsc#1236250).

* CVE-2025-23166: improper error handling in async cryptographic operations

crashes process (bsc#1243218).

* CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp

* CVE-2025-55131: timeout-based race conditions allow for allocations that

contain leftover data from operations and lead to exposure of in-

process secrets (bsc#1256570).

* CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can

cause a crash due to an unhandled error (bsc#1256573).

* CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when

`async_hooks.createHook()` is enabled can lead to crash (bsc#1256574).

* CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive

sockets can lead to incorrect response...

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-4355

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-4355

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-4355

zypper in -t patch SUSE-2026-4355

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-4355

* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)

* nodejs16-debugsource-16.20.2-150400.3.42.1

* nodejs16-16.20.2-150400.3.42.1

* npm16-16.20.2-150400.3.42.1

* nodejs16-devel-16.20.2-150400.3.42.1

* nodejs16-debuginfo-16.20.2-150400.3.42.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)

* nodejs16-docs-16.20.2-150400.3.42.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64

* nodejs16-debugsource-16.20.2-150400.3.42.1

* nodejs16-16.20.2-150400.3.42.1

* npm16-16.20.2-150400.3.42.1

* nodejs16-devel-16.20.2-150400.3.42.1

* nodejs16-debuginfo-16.20.2-150400.3.42.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)

* nodejs16-docs-16.20.2-150400.3.42.1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64

* nodejs16-debugsource-16.20.2-150400.3.42.1

* nodejs16-16.20.2-150400.3.42.1

* npm16-16.20.2-150400.3.42.1

* nodejs16-devel-16.20.2-150400.3.42.1

*

*

*

*

*

*

*

*

*

*

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases