OPENSUSE-SU-2025:15802-1
Vulnerability from csaf_opensuse - Published: 2025-12-08 00:00 - Updated: 2025-12-08 00:00Summary
corepack24-24.11.1-2.1 on GA media
Notes
Title of the patch
corepack24-24.11.1-2.1 on GA media
Description of the patch
These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15802
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "corepack24-24.11.1-2.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2025-15802",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15802-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-21538 page",
"url": "https://www.suse.com/security/cve/CVE-2024-21538/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-22018 page",
"url": "https://www.suse.com/security/cve/CVE-2024-22018/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-22020 page",
"url": "https://www.suse.com/security/cve/CVE-2024-22020/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-36137 page",
"url": "https://www.suse.com/security/cve/CVE-2024-36137/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-36138 page",
"url": "https://www.suse.com/security/cve/CVE-2024-36138/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-37372 page",
"url": "https://www.suse.com/security/cve/CVE-2024-37372/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22150 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22150/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23083 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23083/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23085 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23085/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23165 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23165/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23166 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23166/"
}
],
"title": "corepack24-24.11.1-2.1 on GA media",
"tracking": {
"current_release_date": "2025-12-08T00:00:00Z",
"generator": {
"date": "2025-12-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:15802-1",
"initial_release_date": "2025-12-08T00:00:00Z",
"revision_history": [
{
"date": "2025-12-08T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "corepack24-24.11.1-2.1.aarch64",
"product": {
"name": "corepack24-24.11.1-2.1.aarch64",
"product_id": "corepack24-24.11.1-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "nodejs24-24.11.1-2.1.aarch64",
"product": {
"name": "nodejs24-24.11.1-2.1.aarch64",
"product_id": "nodejs24-24.11.1-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "nodejs24-devel-24.11.1-2.1.aarch64",
"product": {
"name": "nodejs24-devel-24.11.1-2.1.aarch64",
"product_id": "nodejs24-devel-24.11.1-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "nodejs24-docs-24.11.1-2.1.aarch64",
"product": {
"name": "nodejs24-docs-24.11.1-2.1.aarch64",
"product_id": "nodejs24-docs-24.11.1-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "npm24-24.11.1-2.1.aarch64",
"product": {
"name": "npm24-24.11.1-2.1.aarch64",
"product_id": "npm24-24.11.1-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "corepack24-24.11.1-2.1.ppc64le",
"product": {
"name": "corepack24-24.11.1-2.1.ppc64le",
"product_id": "corepack24-24.11.1-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "nodejs24-24.11.1-2.1.ppc64le",
"product": {
"name": "nodejs24-24.11.1-2.1.ppc64le",
"product_id": "nodejs24-24.11.1-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "nodejs24-devel-24.11.1-2.1.ppc64le",
"product": {
"name": "nodejs24-devel-24.11.1-2.1.ppc64le",
"product_id": "nodejs24-devel-24.11.1-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "nodejs24-docs-24.11.1-2.1.ppc64le",
"product": {
"name": "nodejs24-docs-24.11.1-2.1.ppc64le",
"product_id": "nodejs24-docs-24.11.1-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "npm24-24.11.1-2.1.ppc64le",
"product": {
"name": "npm24-24.11.1-2.1.ppc64le",
"product_id": "npm24-24.11.1-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "corepack24-24.11.1-2.1.s390x",
"product": {
"name": "corepack24-24.11.1-2.1.s390x",
"product_id": "corepack24-24.11.1-2.1.s390x"
}
},
{
"category": "product_version",
"name": "nodejs24-24.11.1-2.1.s390x",
"product": {
"name": "nodejs24-24.11.1-2.1.s390x",
"product_id": "nodejs24-24.11.1-2.1.s390x"
}
},
{
"category": "product_version",
"name": "nodejs24-devel-24.11.1-2.1.s390x",
"product": {
"name": "nodejs24-devel-24.11.1-2.1.s390x",
"product_id": "nodejs24-devel-24.11.1-2.1.s390x"
}
},
{
"category": "product_version",
"name": "nodejs24-docs-24.11.1-2.1.s390x",
"product": {
"name": "nodejs24-docs-24.11.1-2.1.s390x",
"product_id": "nodejs24-docs-24.11.1-2.1.s390x"
}
},
{
"category": "product_version",
"name": "npm24-24.11.1-2.1.s390x",
"product": {
"name": "npm24-24.11.1-2.1.s390x",
"product_id": "npm24-24.11.1-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "corepack24-24.11.1-2.1.x86_64",
"product": {
"name": "corepack24-24.11.1-2.1.x86_64",
"product_id": "corepack24-24.11.1-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "nodejs24-24.11.1-2.1.x86_64",
"product": {
"name": "nodejs24-24.11.1-2.1.x86_64",
"product_id": "nodejs24-24.11.1-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "nodejs24-devel-24.11.1-2.1.x86_64",
"product": {
"name": "nodejs24-devel-24.11.1-2.1.x86_64",
"product_id": "nodejs24-devel-24.11.1-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "nodejs24-docs-24.11.1-2.1.x86_64",
"product": {
"name": "nodejs24-docs-24.11.1-2.1.x86_64",
"product_id": "nodejs24-docs-24.11.1-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "npm24-24.11.1-2.1.x86_64",
"product": {
"name": "npm24-24.11.1-2.1.x86_64",
"product_id": "npm24-24.11.1-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "corepack24-24.11.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64"
},
"product_reference": "corepack24-24.11.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "corepack24-24.11.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le"
},
"product_reference": "corepack24-24.11.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "corepack24-24.11.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x"
},
"product_reference": "corepack24-24.11.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "corepack24-24.11.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64"
},
"product_reference": "corepack24-24.11.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-24.11.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64"
},
"product_reference": "nodejs24-24.11.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-24.11.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le"
},
"product_reference": "nodejs24-24.11.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-24.11.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x"
},
"product_reference": "nodejs24-24.11.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-24.11.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64"
},
"product_reference": "nodejs24-24.11.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-24.11.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64"
},
"product_reference": "nodejs24-devel-24.11.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-24.11.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le"
},
"product_reference": "nodejs24-devel-24.11.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-24.11.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x"
},
"product_reference": "nodejs24-devel-24.11.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-24.11.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64"
},
"product_reference": "nodejs24-devel-24.11.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-24.11.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64"
},
"product_reference": "nodejs24-docs-24.11.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-24.11.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le"
},
"product_reference": "nodejs24-docs-24.11.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-24.11.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x"
},
"product_reference": "nodejs24-docs-24.11.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-24.11.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64"
},
"product_reference": "nodejs24-docs-24.11.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm24-24.11.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64"
},
"product_reference": "npm24-24.11.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm24-24.11.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le"
},
"product_reference": "npm24-24.11.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm24-24.11.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x"
},
"product_reference": "npm24-24.11.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm24-24.11.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
},
"product_reference": "npm24-24.11.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-21538",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-21538"
}
],
"notes": [
{
"category": "general",
"text": "Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-21538",
"url": "https://www.suse.com/security/cve/CVE-2024-21538"
},
{
"category": "external",
"summary": "SUSE Bug 1233843 for CVE-2024-21538",
"url": "https://bugzilla.suse.com/1233843"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-21538"
},
{
"cve": "CVE-2024-22018",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-22018"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-22018",
"url": "https://www.suse.com/security/cve/CVE-2024-22018"
},
{
"category": "external",
"summary": "SUSE Bug 1227562 for CVE-2024-22018",
"url": "https://bugzilla.suse.com/1227562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2024-22018"
},
{
"cve": "CVE-2024-22020",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-22020"
}
],
"notes": [
{
"category": "general",
"text": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-22020",
"url": "https://www.suse.com/security/cve/CVE-2024-22020"
},
{
"category": "external",
"summary": "SUSE Bug 1227554 for CVE-2024-22020",
"url": "https://bugzilla.suse.com/1227554"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-22020"
},
{
"cve": "CVE-2024-36137",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-36137"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-36137",
"url": "https://www.suse.com/security/cve/CVE-2024-36137"
},
{
"category": "external",
"summary": "SUSE Bug 1227561 for CVE-2024-36137",
"url": "https://bugzilla.suse.com/1227561"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2024-36137"
},
{
"cve": "CVE-2024-36138",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-36138"
}
],
"notes": [
{
"category": "general",
"text": "Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-36138",
"url": "https://www.suse.com/security/cve/CVE-2024-36138"
},
{
"category": "external",
"summary": "SUSE Bug 1227560 for CVE-2024-36138",
"url": "https://bugzilla.suse.com/1227560"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-36138"
},
{
"cve": "CVE-2024-37372",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-37372"
}
],
"notes": [
{
"category": "general",
"text": "The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-37372",
"url": "https://www.suse.com/security/cve/CVE-2024-37372"
},
{
"category": "external",
"summary": "SUSE Bug 1227563 for CVE-2024-37372",
"url": "https://bugzilla.suse.com/1227563"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2024-37372"
},
{
"cve": "CVE-2025-22150",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22150"
}
],
"notes": [
{
"category": "general",
"text": "Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22150",
"url": "https://www.suse.com/security/cve/CVE-2025-22150"
},
{
"category": "external",
"summary": "SUSE Bug 1236257 for CVE-2025-22150",
"url": "https://bugzilla.suse.com/1236257"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-22150"
},
{
"cve": "CVE-2025-23083",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23083"
}
],
"notes": [
{
"category": "general",
"text": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23083",
"url": "https://www.suse.com/security/cve/CVE-2025-23083"
},
{
"category": "external",
"summary": "SUSE Bug 1236251 for CVE-2025-23083",
"url": "https://bugzilla.suse.com/1236251"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-23083"
},
{
"cve": "CVE-2025-23085",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23085"
}
],
"notes": [
{
"category": "general",
"text": "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\r\n\r\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23085",
"url": "https://www.suse.com/security/cve/CVE-2025-23085"
},
{
"category": "external",
"summary": "SUSE Bug 1236250 for CVE-2025-23085",
"url": "https://bugzilla.suse.com/1236250"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-23085"
},
{
"cve": "CVE-2025-23165",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23165"
}
],
"notes": [
{
"category": "general",
"text": "In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23165",
"url": "https://www.suse.com/security/cve/CVE-2025-23165"
},
{
"category": "external",
"summary": "SUSE Bug 1243217 for CVE-2025-23165",
"url": "https://bugzilla.suse.com/1243217"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-23165"
},
{
"cve": "CVE-2025-23166",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23166"
}
],
"notes": [
{
"category": "general",
"text": "The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23166",
"url": "https://www.suse.com/security/cve/CVE-2025-23166"
},
{
"category": "external",
"summary": "SUSE Bug 1243218 for CVE-2025-23166",
"url": "https://bugzilla.suse.com/1243218"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:corepack24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-devel-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:nodejs24-docs-24.11.1-2.1.x86_64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.aarch64",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.ppc64le",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.s390x",
"openSUSE Tumbleweed:npm24-24.11.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-23166"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…