Security update for nodejs22

Open Source Vulnerabilities SUSE-SU-2026:2695-1

This update for nodejs22 fixes the following issues: - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593). - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592). - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598). - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618). - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605). - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606). - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608). - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554). - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611). - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609). - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555). - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482). - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479). - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477). - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481). - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853). - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274). - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` ( bsc#1266318). - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).