{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "nodejs26-26.3.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11110",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11110-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-21538 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-21538/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22018 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22018/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22020 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22020/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36137 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36138 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36138/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-37372 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-37372/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22150 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22150/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23083 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23083/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23085 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23085/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23165 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23165/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23166 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23166/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55130 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55131 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55131/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55132 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-59464 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-59464/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-59465 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-59465/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-59466 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-59466/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21637 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21637/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21710 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21710/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21712 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21712/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21713 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21713/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21714 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21714/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21715 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21715/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21716 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21716/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21717 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21717/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22036 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22036/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48615 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48615/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48617 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48617/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48618 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48618/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48619 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48619/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48928 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48928/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48930 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48930/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48931 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48931/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48933 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48933/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48934 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48934/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48935 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48935/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48936 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48936/"
      }
    ],
    "title": "nodejs26-26.3.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-14T12:52:21Z",
      "generator": {
        "date": "2026-06-23T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11110-1",
      "initial_release_date": "2026-06-23T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-23T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-14T12:52:21Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-26.3.1-1.1.aarch64",
                "product": {
                  "name": "nodejs26-26.3.1-1.1.aarch64",
                  "product_id": "nodejs26-26.3.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-26.3.1-1.1.aarch64",
                "product": {
                  "name": "nodejs26-devel-26.3.1-1.1.aarch64",
                  "product_id": "nodejs26-devel-26.3.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-26.3.1-1.1.aarch64",
                "product": {
                  "name": "nodejs26-docs-26.3.1-1.1.aarch64",
                  "product_id": "nodejs26-docs-26.3.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "npm26-26.3.1-1.1.aarch64",
                "product": {
                  "name": "npm26-26.3.1-1.1.aarch64",
                  "product_id": "npm26-26.3.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-26.3.1-1.1.ppc64le",
                "product": {
                  "name": "nodejs26-26.3.1-1.1.ppc64le",
                  "product_id": "nodejs26-26.3.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-26.3.1-1.1.ppc64le",
                "product": {
                  "name": "nodejs26-devel-26.3.1-1.1.ppc64le",
                  "product_id": "nodejs26-devel-26.3.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-26.3.1-1.1.ppc64le",
                "product": {
                  "name": "nodejs26-docs-26.3.1-1.1.ppc64le",
                  "product_id": "nodejs26-docs-26.3.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "npm26-26.3.1-1.1.ppc64le",
                "product": {
                  "name": "npm26-26.3.1-1.1.ppc64le",
                  "product_id": "npm26-26.3.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-26.3.1-1.1.s390x",
                "product": {
                  "name": "nodejs26-26.3.1-1.1.s390x",
                  "product_id": "nodejs26-26.3.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-26.3.1-1.1.s390x",
                "product": {
                  "name": "nodejs26-devel-26.3.1-1.1.s390x",
                  "product_id": "nodejs26-devel-26.3.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-26.3.1-1.1.s390x",
                "product": {
                  "name": "nodejs26-docs-26.3.1-1.1.s390x",
                  "product_id": "nodejs26-docs-26.3.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "npm26-26.3.1-1.1.s390x",
                "product": {
                  "name": "npm26-26.3.1-1.1.s390x",
                  "product_id": "npm26-26.3.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-26.3.1-1.1.x86_64",
                "product": {
                  "name": "nodejs26-26.3.1-1.1.x86_64",
                  "product_id": "nodejs26-26.3.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-26.3.1-1.1.x86_64",
                "product": {
                  "name": "nodejs26-devel-26.3.1-1.1.x86_64",
                  "product_id": "nodejs26-devel-26.3.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-26.3.1-1.1.x86_64",
                "product": {
                  "name": "nodejs26-docs-26.3.1-1.1.x86_64",
                  "product_id": "nodejs26-docs-26.3.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm26-26.3.1-1.1.x86_64",
                "product": {
                  "name": "npm26-26.3.1-1.1.x86_64",
                  "product_id": "npm26-26.3.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-26.3.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64"
        },
        "product_reference": "nodejs26-26.3.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-26.3.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le"
        },
        "product_reference": "nodejs26-26.3.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-26.3.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x"
        },
        "product_reference": "nodejs26-26.3.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-26.3.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64"
        },
        "product_reference": "nodejs26-26.3.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-26.3.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64"
        },
        "product_reference": "nodejs26-devel-26.3.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-26.3.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le"
        },
        "product_reference": "nodejs26-devel-26.3.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-26.3.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x"
        },
        "product_reference": "nodejs26-devel-26.3.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-26.3.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64"
        },
        "product_reference": "nodejs26-devel-26.3.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-26.3.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64"
        },
        "product_reference": "nodejs26-docs-26.3.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-26.3.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le"
        },
        "product_reference": "nodejs26-docs-26.3.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-26.3.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x"
        },
        "product_reference": "nodejs26-docs-26.3.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-26.3.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64"
        },
        "product_reference": "nodejs26-docs-26.3.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm26-26.3.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64"
        },
        "product_reference": "npm26-26.3.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm26-26.3.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le"
        },
        "product_reference": "npm26-26.3.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm26-26.3.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x"
        },
        "product_reference": "npm26-26.3.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm26-26.3.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        },
        "product_reference": "npm26-26.3.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-21538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-21538",
          "url": "https://www.suse.com/security/cve/CVE-2024-21538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233843 for CVE-2024-21538",
          "url": "https://bugzilla.suse.com/1233843"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-21538"
    },
    {
      "cve": "CVE-2024-22018",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22018"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22018",
          "url": "https://www.suse.com/security/cve/CVE-2024-22018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227562 for CVE-2024-22018",
          "url": "https://bugzilla.suse.com/1227562"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-22018"
    },
    {
      "cve": "CVE-2024-22020",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22020"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22020",
          "url": "https://www.suse.com/security/cve/CVE-2024-22020"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227554 for CVE-2024-22020",
          "url": "https://bugzilla.suse.com/1227554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-22020"
    },
    {
      "cve": "CVE-2024-36137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36137",
          "url": "https://www.suse.com/security/cve/CVE-2024-36137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227561 for CVE-2024-36137",
          "url": "https://bugzilla.suse.com/1227561"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260462 for CVE-2024-36137",
          "url": "https://bugzilla.suse.com/1260462"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2024-36137",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36137"
    },
    {
      "cve": "CVE-2024-36138",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36138"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36138",
          "url": "https://www.suse.com/security/cve/CVE-2024-36138"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227560 for CVE-2024-36138",
          "url": "https://bugzilla.suse.com/1227560"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36138"
    },
    {
      "cve": "CVE-2024-37372",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-37372"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-37372",
          "url": "https://www.suse.com/security/cve/CVE-2024-37372"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227563 for CVE-2024-37372",
          "url": "https://bugzilla.suse.com/1227563"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-37372"
    },
    {
      "cve": "CVE-2025-22150",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22150"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22150",
          "url": "https://www.suse.com/security/cve/CVE-2025-22150"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236257 for CVE-2025-22150",
          "url": "https://bugzilla.suse.com/1236257"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22150"
    },
    {
      "cve": "CVE-2025-23083",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23083"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23083",
          "url": "https://www.suse.com/security/cve/CVE-2025-23083"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236251 for CVE-2025-23083",
          "url": "https://bugzilla.suse.com/1236251"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-23083"
    },
    {
      "cve": "CVE-2025-23085",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23085"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\r\n\r\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23085",
          "url": "https://www.suse.com/security/cve/CVE-2025-23085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236250 for CVE-2025-23085",
          "url": "https://bugzilla.suse.com/1236250"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-23085"
    },
    {
      "cve": "CVE-2025-23165",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23165"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23165",
          "url": "https://www.suse.com/security/cve/CVE-2025-23165"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243217 for CVE-2025-23165",
          "url": "https://bugzilla.suse.com/1243217"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-23165"
    },
    {
      "cve": "CVE-2025-23166",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23166"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23166",
          "url": "https://www.suse.com/security/cve/CVE-2025-23166"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243218 for CVE-2025-23166",
          "url": "https://bugzilla.suse.com/1243218"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-23166"
    },
    {
      "cve": "CVE-2025-55130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js\u0027s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55130",
          "url": "https://www.suse.com/security/cve/CVE-2025-55130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256569 for CVE-2025-55130",
          "url": "https://bugzilla.suse.com/1256569"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256570 for CVE-2025-55130",
          "url": "https://bugzilla.suse.com/1256570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-55130"
    },
    {
      "cve": "CVE-2025-55131",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55131"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js\u0027s buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55131",
          "url": "https://www.suse.com/security/cve/CVE-2025-55131"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256570 for CVE-2025-55131",
          "url": "https://bugzilla.suse.com/1256570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-55131"
    },
    {
      "cve": "CVE-2025-55132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js\u0027s permission model allows a file\u0027s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55132",
          "url": "https://www.suse.com/security/cve/CVE-2025-55132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256571 for CVE-2025-55132",
          "url": "https://bugzilla.suse.com/1256571"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-55132"
    },
    {
      "cve": "CVE-2025-59464",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-59464"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A memory leak in Node.js\u0027s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-59464",
          "url": "https://www.suse.com/security/cve/CVE-2025-59464"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256570 for CVE-2025-59464",
          "url": "https://bugzilla.suse.com/1256570"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256572 for CVE-2025-59464",
          "url": "https://bugzilla.suse.com/1256572"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-59464"
    },
    {
      "cve": "CVE-2025-59465",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-59465"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0027secureConnection\u0027, socket =\u003e {\n  socket.on(\u0027error\u0027, err =\u003e {\n    console.log(err)\n  })\n})\n```",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-59465",
          "url": "https://www.suse.com/security/cve/CVE-2025-59465"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256573 for CVE-2025-59465",
          "url": "https://bugzilla.suse.com/1256573"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-59465"
    },
    {
      "cve": "CVE-2025-59466",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-59466"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on(\u0027uncaughtException\u0027)`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-59466",
          "url": "https://www.suse.com/security/cve/CVE-2025-59466"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256574 for CVE-2025-59466",
          "url": "https://bugzilla.suse.com/1256574"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-59466"
    },
    {
      "cve": "CVE-2026-21637",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21637"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21637",
          "url": "https://www.suse.com/security/cve/CVE-2026-21637"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256576 for CVE-2026-21637",
          "url": "https://bugzilla.suse.com/1256576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21637",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21637"
    },
    {
      "cve": "CVE-2026-21710",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21710"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21710",
          "url": "https://www.suse.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260455 for CVE-2026-21710",
          "url": "https://bugzilla.suse.com/1260455"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21710",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-21710"
    },
    {
      "cve": "CVE-2026-21712",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21712"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21712",
          "url": "https://www.suse.com/security/cve/CVE-2026-21712"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260460 for CVE-2026-21712",
          "url": "https://bugzilla.suse.com/1260460"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21712",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21712"
    },
    {
      "cve": "CVE-2026-21713",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21713"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\r\n\r\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21713",
          "url": "https://www.suse.com/security/cve/CVE-2026-21713"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260463 for CVE-2026-21713",
          "url": "https://bugzilla.suse.com/1260463"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21713",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21713"
    },
    {
      "cve": "CVE-2026-21714",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21714"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21714",
          "url": "https://www.suse.com/security/cve/CVE-2026-21714"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260480 for CVE-2026-21714",
          "url": "https://bugzilla.suse.com/1260480"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21714",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21714"
    },
    {
      "cve": "CVE-2026-21715",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21715"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21715",
          "url": "https://www.suse.com/security/cve/CVE-2026-21715"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21715",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-21715"
    },
    {
      "cve": "CVE-2026-21716",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21716"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21716",
          "url": "https://www.suse.com/security/cve/CVE-2026-21716"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260462 for CVE-2026-21716",
          "url": "https://bugzilla.suse.com/1260462"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21716",
          "url": "https://bugzilla.suse.com/1260482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21716"
    },
    {
      "cve": "CVE-2026-21717",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21717"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in V8\u0027s string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8\u0027s internal string table, an attacker can significantly degrade performance of the Node.js process.\r\n\r\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21717",
          "url": "https://www.suse.com/security/cve/CVE-2026-21717"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260482 for CVE-2026-21717",
          "url": "https://bugzilla.suse.com/1260482"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260494 for CVE-2026-21717",
          "url": "https://bugzilla.suse.com/1260494"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21717"
    },
    {
      "cve": "CVE-2026-22036",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22036"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22036",
          "url": "https://www.suse.com/security/cve/CVE-2026-22036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256843 for CVE-2026-22036",
          "url": "https://bugzilla.suse.com/1256843"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22036"
    },
    {
      "cve": "CVE-2026-48615",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48615"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\r\n\r\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48615",
          "url": "https://www.suse.com/security/cve/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268598 for CVE-2026-48615",
          "url": "https://bugzilla.suse.com/1268598"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-48615"
    },
    {
      "cve": "CVE-2026-48617",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48617"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48617",
          "url": "https://www.suse.com/security/cve/CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268554 for CVE-2026-48617",
          "url": "https://bugzilla.suse.com/1268554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48617"
    },
    {
      "cve": "CVE-2026-48618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48618",
          "url": "https://www.suse.com/security/cve/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268593 for CVE-2026-48618",
          "url": "https://bugzilla.suse.com/1268593"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-48618"
    },
    {
      "cve": "CVE-2026-48619",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48619"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48619",
          "url": "https://www.suse.com/security/cve/CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268618 for CVE-2026-48619",
          "url": "https://bugzilla.suse.com/1268618"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48619"
    },
    {
      "cve": "CVE-2026-48928",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48928"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48928",
          "url": "https://www.suse.com/security/cve/CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268605 for CVE-2026-48928",
          "url": "https://bugzilla.suse.com/1268605"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48928"
    },
    {
      "cve": "CVE-2026-48930",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48930"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48930",
          "url": "https://www.suse.com/security/cve/CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268606 for CVE-2026-48930",
          "url": "https://bugzilla.suse.com/1268606"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48930"
    },
    {
      "cve": "CVE-2026-48931",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48931"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48931",
          "url": "https://www.suse.com/security/cve/CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268611 for CVE-2026-48931",
          "url": "https://bugzilla.suse.com/1268611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48931"
    },
    {
      "cve": "CVE-2026-48933",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48933"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48933",
          "url": "https://www.suse.com/security/cve/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268592 for CVE-2026-48933",
          "url": "https://bugzilla.suse.com/1268592"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-48933"
    },
    {
      "cve": "CVE-2026-48934",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48934"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48934",
          "url": "https://www.suse.com/security/cve/CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268608 for CVE-2026-48934",
          "url": "https://bugzilla.suse.com/1268608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272945 for CVE-2026-48934",
          "url": "https://bugzilla.suse.com/1272945"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48934"
    },
    {
      "cve": "CVE-2026-48935",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48935"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48935",
          "url": "https://www.suse.com/security/cve/CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268609 for CVE-2026-48935",
          "url": "https://bugzilla.suse.com/1268609"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48935"
    },
    {
      "cve": "CVE-2026-48936",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48936"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.\r\n\r\nThis vulnerability affects one supported release line: **Node.js 26**.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
          "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48936",
          "url": "https://www.suse.com/security/cve/CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268610 for CVE-2026-48936",
          "url": "https://bugzilla.suse.com/1268610"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-devel-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:nodejs26-docs-26.3.1-1.1.x86_64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.aarch64",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.ppc64le",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.s390x",
            "openSUSE Tumbleweed:npm26-26.3.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48936"
    }
  ]
}