CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

• https://hackerone.com/reports/3456148
• https://github.com/advisories/GHSA-gm62-xv2j-4w53
• https://curl.se/docs/CVE-2022-32206.html

Root has patched CVE-2026-22036 in the undici package for Root:npm. Multiple fixed versions available.

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

TuxCare rebuilt undici to address 3 CVEs. Fixed in 6.11.1-tuxcare.1.

TuxCare rebuilt undici to address 1 CVE. Fixed in 5.29.0-tuxcare.3.

TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.6.

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.

TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

These are all security issues fixed in the corepack22-22.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.13.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs22 fixes the following issues:

Update to 22.22.0:

• CVE-2025-55130: file system permissions bypass via crafted symlinks (bsc#1256569).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-55132: a file's access and modification timestamps can be changed via futimes() even when the process has only read permissions (bsc#1256571).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).

For full changelog, please see https://nodejs.org/en/blog

This update for nodejs22 fixes the following issues:

Security fixes:

• CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading to resource exhaustion (bsc#1256848)
• CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass TLS error handling and causing denial of service (bsc#1256576)
• CVE-2025-55132: Fixed futimes() ability to acces file even if process has read permissions only (bsc#1256571)
• CVE-2025-55131: Fixed race condition that allowed allocations with leftover data leading to in-process secrets exposure (bsc#1256570)
• CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
• CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading to crash (bsc#1256573)
• CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error leading to crash (bsc#1256574)

Other fixes:

• Update to 22.22.0:

  • deps: updated undici to 6.23.0
  • deps: updated bundled c-ares to 1.34.6 (if used)
  • add TLSSocket default error handler
  • disable futimes when permission model is enabled
  • require full read and write to symlink APIs
  • rethrow stack overflow exceptions in async_hooks
  • refactor unsafe buffer creation to remove zero-fill toggle
  • route callback exceptions through error handlers

• Update to 22.21.1:

  • src: avoid unnecessary string -> char* -> string round trips
  • src: remove unnecessary shadowed functions on Utf8Value & BufferValue
  • process: fix hrtime fast call signatures
  • http: improve writeEarlyHints by avoiding for-of loop

• Update to 22.21.0:

  • cli: add --use-env-proxy
  • http: support http proxy for fetch under NODE_USE_ENV_PROXY
  • http: add shouldUpgradeCallback to let servers control HTTP upgrades
  • http,https: add built-in proxy support in http/https.request and Agent
  • src: add percentage support to --max-old-space-size

• Update to 22.20.0

  • doc: stabilize --disable-sigusr1
  • doc: mark path.matchesGlob as stable
  • http: add Agent.agentKeepAliveTimeoutBuffer option
  • http2: add support for raw header arrays in h2Stream.respond()
  • inspector: add http2 tracking support
  • sea: implement execArgvExtension
  • sea: support execArgv in sea config
  • stream: add brotli support to CompressionStream and DecompressionStream
  • test_runner: support object property mocking
  • worker: add cpu profile APIs for worker

• Update to 22.19.0

  • cli: add NODE_USE_SYSTEM_CA=1
  • cli: support ${pid} placeholder in --cpu-prof-name
  • crypto: add tls.setDefaultCACertificates()
  • dns: support max timeout
  • doc: update the instruction on how to verify releases
  • esm: unflag --experimental-wasm-modules
  • http: add server.keepAliveTimeoutBuffer option
  • lib: docs deprecate http*
  • net: update net.blocklist to allow file save and file management
  • process: add threadCpuUsage
  • zlib: add dictionary support to zstdCompress and zstdDecompress

• Update to 22.18.0:

  • deps: update amaro to 1.1.0
  • doc: add all watch-mode related flags to node.1
  • doc: add islandryu to collaborators
  • esm: implement import.meta.main
  • fs: allow correct handling of burst in fs-events with AsyncIterator
  • permission: propagate permission model flags on spawn
  • sqlite: add support for readBigInts option in db connection level
  • src,permission: add support to permission.has(addon)
  • url: add fileURLToPathBuffer API
  • watch: add --watch-kill-signal flag
  • worker: make Worker async disposable

This update for nodejs22 fixes the following issues:

Security fixes:

• CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading to resource exhaustion (bsc#1256848)
• CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass TLS error handling and causing denial of service (bsc#1256576)
• CVE-2025-55132: Fixed futimes() ability to acces file even if process has read permissions only (bsc#1256571)
• CVE-2025-55131: Fixed race condition that allowed allocations with leftover data leading to in-process secrets exposure (bsc#1256570)
• CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
• CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading to crash (bsc#1256573)
• CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error leading to crash (bsc#1256574)

Other fixes:

• Update to 22.22.0:

  • deps: updated undici to 6.23.0
  • deps: updated bundled c-ares to 1.34.6 (if used)
  • add TLSSocket default error handler
  • disable futimes when permission model is enabled
  • require full read and write to symlink APIs
  • rethrow stack overflow exceptions in async_hooks
  • refactor unsafe buffer creation to remove zero-fill toggle
  • route callback exceptions through error handlers

• Update to 22.21.1:

  • src: avoid unnecessary string -> char* -> string round trips
  • src: remove unnecessary shadowed functions on Utf8Value & BufferValue
  • process: fix hrtime fast call signatures
  • http: improve writeEarlyHints by avoiding for-of loop

• Update to 22.21.0:

  • cli: add --use-env-proxy
  • http: support http proxy for fetch under NODE_USE_ENV_PROXY
  • http: add shouldUpgradeCallback to let servers control HTTP upgrades
  • http,https: add built-in proxy support in http/https.request and Agent
  • src: add percentage support to --max-old-space-size

• Update to 22.20.0

  • doc: stabilize --disable-sigusr1
  • doc: mark path.matchesGlob as stable
  • http: add Agent.agentKeepAliveTimeoutBuffer option
  • http2: add support for raw header arrays in h2Stream.respond()
  • inspector: add http2 tracking support
  • sea: implement execArgvExtension
  • sea: support execArgv in sea config
  • stream: add brotli support to CompressionStream and DecompressionStream
  • test_runner: support object property mocking
  • worker: add cpu profile APIs for worker

• Update to 22.19.0

  • cli: add NODE_USE_SYSTEM_CA=1
  • cli: support ${pid} placeholder in --cpu-prof-name
  • crypto: add tls.setDefaultCACertificates()
  • dns: support max timeout
  • doc: update the instruction on how to verify releases
  • esm: unflag --experimental-wasm-modules
  • http: add server.keepAliveTimeoutBuffer option
  • lib: docs deprecate http*
  • net: update net.blocklist to allow file save and file management
  • process: add threadCpuUsage
  • zlib: add dictionary support to zstdCompress and zstdDecompress

• Update to 22.18.0:

  • deps: update amaro to 1.1.0
  • doc: add all watch-mode related flags to node.1
  • doc: add islandryu to collaborators
  • esm: implement import.meta.main
  • fs: allow correct handling of burst in fs-events with AsyncIterator
  • permission: propagate permission model flags on spawn
  • sqlite: add support for readBigInts option in db connection level
  • src,permission: add support to permission.has(addon)
  • url: add fileURLToPathBuffer API
  • watch: add --watch-kill-signal flag
  • worker: make Worker async disposable

This update for nodejs20 fixes the following issues:

• Update to 20.20.0:
• CVE-2026-22036: Updated undici to 6.23.0 (bsc#1256848)
• CVE-2025-59465: Add TLSSocket default error handler (bsc#1256573)
• CVE-2025-55132: Disable futimes when permission model is enabled (bsc#1256571)
• CVE-2025-55130: Require full read and write to symlink APIs (bsc#1256569)
• CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks (bsc#1256574)
• CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle (bsc#1256570)
• CVE-2026-21637: Route callback exceptions through error handlers (bsc#1256576)

This update for nodejs20 fixes the following issues:

• Update to 20.20.0:
• CVE-2026-22036: Updated undici to 6.23.0 (bsc#1256848)
• CVE-2025-59465: Add TLSSocket default error handler (bsc#1256573)
• CVE-2025-55132: Disable futimes when permission model is enabled (bsc#1256571)
• CVE-2025-55130: Require full read and write to symlink APIs (bsc#1256569)
• CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks (bsc#1256574)
• CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle (bsc#1256570)
• CVE-2026-21637: Route callback exceptions through error handlers (bsc#1256576)

This update for nodejs22 fixes the following issues:

Update to 22.22.0:

• CVE-2025-55130: file system permissions bypass via crafted symlinks (bsc#1256569).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-55132: a file's access and modification timestamps can be changed via futimes() even when the process has only read permissions (bsc#1256571).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).

For full changelog, please see https://nodejs.org/en/blog

This update for nodejs20 fixes the following issues:

• CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
• CVE-2026-69192: ip-address: Address4…

This update for nodejs20 fixes the following issues:

• CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
• CVE-2026-69192: ip-address: Address4…

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

This update for nodejs16 fixes the following issues:

• CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).