Description of the patch:
This update for nodejs24 fixes the following issues
Update to 24.17.0:
- CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response
delivery (bsc#1268479).
- CVE-2026-9496: pacote: excessive CPU consumption in
addGitSha when processing a specially crafted spec.rawSpec
value can lead to DoS (bsc#1266318).
- CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
(bsc#1268481).
- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
- CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
- CVE-2026-48617: permission model enforcement bypass via
process.report.writeReport() path misvalidation
(bsc#1268554).
- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to
resolver and verifier hostname normalization mismatch (bsc#1268593).
- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname
matching (bsc#1268605).
- CVE-2026-48930: Embedded-nul...