SUSE nodejs16 Important Vulnerabilities Patch Advisory 2026-4355

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

## This update for nodejs16 fixes the following issues: * CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250). * CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218). * CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220). * CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from operations and lead to exposure of in- process secrets (bsc#1256570). * CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573). * CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when

## This update for nodejs16 fixes the following issues: * CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250). * CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218). * CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220). * CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from operations and lead to exposure of in- process secrets (bsc#1256570). * CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573). * CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when

Announcement ID: SUSE-SU-2026:4355-1 Release Date: 2026-09-28T08:55:58Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases