Skip to content
Critical DoS Vulnerabilities in openSUSE Node.js 20 Require Immediate Action

Critical DoS Vulnerabilities in openSUSE Node.js 20 Require Immediate Action

First seen 3 Sep 2026, 17:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 4, 2026 at 17:16 UTC
  • •Multiple critical DoS vulnerabilities in Node.js 20 require urgent patching.
  • •Affected systems include SUSE Linux Enterprise Server and openSUSE Leap.
  • •Patches address issues in undici and pacote libraries impacting service stability.

A significant security update for Node.js 20 in openSUSE addresses multiple denial of service (DoS) vulnerabilities. The update includes fixes for CVE-2025-22150, CVE-2026-6733, CVE-2026-9496, CVE-2026-9679, CVE-2026-11525, and CVE-2026-12151, which could lead to severe performance degradation or service outages. Affected systems include SUSE Linux Enterprise Server and openSUSE Leap, with specific versions listed in the advisory. The vulnerabilities stem from issues in the undici and pacote libraries, affecting how HTTP requests and responses are handled. Administrators are urged to apply the patches immediately to mitigate risks. The vulnerabilities were disclosed between January and June 2026, with some having known exploit methods. Current status indicates that patches are available, and organizations should prioritize their implementation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 46d ago How this analysis works

Timeline

2025-01-21
CVE-2025-22150 published
Predictable random values in multipart/form-data requests can lead to vulnerabilities.
Linuxsecurity
2026-05-26
CVE-2026-9496 published
Excessive CPU consumption in addGitSha can lead to denial of service.
Linuxsecurity
2026-06-17
CVE-2026-9679 published
HTTP header injection via Set-Cookie percent-decoding poses security risks.
Linuxsecurity
2026-06-17
CVE-2026-12151 published
Denial of service due to unbounded memory growth via WebSocket frames identified.
Linuxsecurity
2026-06-17
CVE-2026-6733 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-17
CVE-2026-11525 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-29
CVE-2026-16728 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-29
CVE-2026-16729 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-03
Patches released for Node.js 20
SUSE released critical updates addressing multiple vulnerabilities in Node.js 20.
Linuxsecurity

More articles in this cluster (4)

Following this threat?

Track SuSE and CVE-2025-22150 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 2