Security update for nodejs20

Announcement ID:	SUSE-SU-2026:0435-1
Release Date:	2026-02-11T09:25:23Z
Rating:	important
References:	bsc#1256569 bsc#1256570 bsc#1256571 bsc#1256573 bsc#1256574 bsc#1256576 bsc#1256848
Cross-References:	CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 CVE-2026-22036
CVSS scores:	CVE-2025-55130 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2025-55130 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-55130 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-55130 ( NVD ): 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2025-55131 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2025-55131 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-55131 ( NVD ): 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVE-2025-55132 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2025-55132 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2025-55132 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2025-55132 ( NVD ): 2.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVE-2025-59465 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-59465 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-59465 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-59466 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-59466 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-59466 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-59466 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-21637 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVE-2026-21637 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-21637 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-21637 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-22036 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVE-2026-22036 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-22036 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-22036 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	openSUSE Leap 15.6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server 15 SP6 LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves seven vulnerabilities can now be installed.

Description:

This update for nodejs20 fixes the following issues:

• Update to 20.20.0:
• CVE-2026-22036: Updated undici to 6.23.0 (bsc#1256848)
• CVE-2025-59465: Add TLSSocket default error handler (bsc#1256573)
• CVE-2025-55132: Disable futimes when permission model is enabled (bsc#1256571)
• CVE-2025-55130: Require full read and write to symlink APIs (bsc#1256569)
• CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks (bsc#1256574)
• CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle (bsc#1256570)
• CVE-2026-21637: Route callback exceptions through error handlers (bsc#1256576)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.6
  zypper in -t patch SUSE-2026-435=1 openSUSE-SLE-15.6-2026-435=1
• SUSE Linux Enterprise Server 15 SP6 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-435=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-435=1

Package List:

• openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
  • nodejs20-debugsource-20.20.0-150600.3.15.1
  • npm20-20.20.0-150600.3.15.1
  • nodejs20-20.20.0-150600.3.15.1
  • nodejs20-debuginfo-20.20.0-150600.3.15.1
  • corepack20-20.20.0-150600.3.15.1
  • nodejs20-devel-20.20.0-150600.3.15.1
• openSUSE Leap 15.6 (noarch)
  • nodejs20-docs-20.20.0-150600.3.15.1
• SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
  • nodejs20-debugsource-20.20.0-150600.3.15.1
  • npm20-20.20.0-150600.3.15.1
  • nodejs20-20.20.0-150600.3.15.1
  • nodejs20-debuginfo-20.20.0-150600.3.15.1
  • nodejs20-devel-20.20.0-150600.3.15.1
• SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
  • nodejs20-docs-20.20.0-150600.3.15.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
  • nodejs20-debugsource-20.20.0-150600.3.15.1
  • npm20-20.20.0-150600.3.15.1
  • nodejs20-20.20.0-150600.3.15.1
  • nodejs20-debuginfo-20.20.0-150600.3.15.1
  • nodejs20-devel-20.20.0-150600.3.15.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
  • nodejs20-docs-20.20.0-150600.3.15.1

References:

• https://www.suse.com/security/cve/CVE-2025-55130.html
• https://www.suse.com/security/cve/CVE-2025-55131.html
• https://www.suse.com/security/cve/CVE-2025-55132.html
• https://www.suse.com/security/cve/CVE-2025-59465.html
• https://www.suse.com/security/cve/CVE-2025-59466.html
• https://www.suse.com/security/cve/CVE-2026-21637.html
• https://www.suse.com/security/cve/CVE-2026-22036.html
• https://bugzilla.suse.com/show_bug.cgi?id=1256569
• https://bugzilla.suse.com/show_bug.cgi?id=1256570
• https://bugzilla.suse.com/show_bug.cgi?id=1256571
• https://bugzilla.suse.com/show_bug.cgi?id=1256573
• https://bugzilla.suse.com/show_bug.cgi?id=1256574
• https://bugzilla.suse.com/show_bug.cgi?id=1256576
• https://bugzilla.suse.com/show_bug.cgi?id=1256848