Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

SUSE 16.0 NodeJS24 Important Resource Exhaustion Vuln 2026-21181-1

suse
Calendar Grey April 21, 2026
Dist Suse Esm H88
Nine vulnerabilities fixed in nodejs24 update for SUSE include important security flaws. Install required patches now.
An update that solves nine vulnerabilities can now be installed.

Summary

## This update for nodejs24 fixes the following issues: Update to version 24.14.1. Security issues fixed: * CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494). * CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462). * CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via `fs.realpathSync.native()` (bsc#1260482). * CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via `WINDOW_UPDATE` frames sent on stream 0 (bsc#1260480).

Topics%20covered

Topics Covered

security advisory SuSE DoS important resource exhaustion nodejs24

References

* bsc#1256572

* bsc#1256576

* bsc#1260455

* bsc#1260460

* bsc#1260462

* bsc#1260463

* bsc#1260480

* bsc#1260482

* bsc#1260494

Cross-

* CVE-2025-59464

* CVE-2026-21637

* CVE-2026-21710

* CVE-2026-21712

* CVE-2026-21713

* CVE-2026-21714

* CVE-2026-21715

* CVE-2026-21716

* CVE-2026-21717

CVSS scores:

* CVE-2025-59464 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2025-59464 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-59464 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2025-59464 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-21637 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:21181-1
Release Date: 2026-04-13T12:29:51Z
Rating: important

Topics%20covered

Topics Covered

security advisory SuSE DoS important resource exhaustion nodejs24

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.