Security update for nodejs24

Open Source Vulnerabilities SUSE-SU-2026:22565-1

This update for nodejs24 fixes the following issues Update to version 24.18.0 (bsc#1269825). Security issues fixed: - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480). - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479). - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` value can lead to DoS (bsc#1266318). - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing (bsc#1268478). - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477). - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header (bsc#1268481). - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482). - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853). - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274). - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097). - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598). - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation (bsc#1268554). - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593). - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618). - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605). - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in resolver bindings (bsc#1268606). - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611). - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592). - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername` leads to unauthorized connections (bsc#1268608). - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609). - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555). Other updates and bugfixes: - Version 24.18.0: - doc: update `blockList` stability status to release candidate - fs: support caller-supplied `readFile()` buffers - http: close pre-request sockets in `closeIdleConnections` - loader: implement package maps - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` - tls: add `certificateCompression` option - vfs: dispatch `node:fs/promises` to mounted VFS instances - vfs: add minimal `node:vfs` subsystem - For changes in older versions, see https://github.com/nodejs/node/releases. - Remove `update-alternatives` from scriptlets if not available. - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun. - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.