Every CVE Search/ Get API key

CVE-2026-2229

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

7.5 HighFix available

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.00%Up 0.9 points since Mar 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process
Record
CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-1284, CWE-248
Updated
2026-11-02
EUVDEUVD-2026-11704 7.5

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process
Record
EUVD-2026-11704
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-v9p9-hfj2-hcw8 7.5

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Impact

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  1. The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  2. The createInflateRaw() call is not wrapped in a try-catch block
  3. The resulting exception propagates up through the call stack and crashes the Node.js process

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Record
GHSA-v9p9-hfj2-hcw8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
NVD 7.5

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process
Record
CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-1284
Updated
2026-11-02
OSVBELL-CVE-2026-2229 7.5
Record
BELL-CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process
Record
CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1284, CWE-248
Updated
2026-11-02
Show 28 moreShow less
OSVDEBIAN-CVE-2026-2229 7.5

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process

Record
DEBIAN-CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-v9p9-hfj2-hcw8 7.5

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Impact

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  1. The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  2. The createInflateRaw() call is not wrapped in a try-catch block
  3. The resulting exception propagates up through the call stack and crashes the Node.js process

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Record
GHSA-v9p9-hfj2-hcw8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVRHSA-2026:7080 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7123 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7302 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7310 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7310
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7350 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7670 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7675 7.5

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7983 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7983
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7080 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7123 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7302 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7350 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7670 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7675 7.5

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-2229 7.5

CVE-2026-2229 in undici - Patched by Root

Root has patched CVE-2026-2229 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-2229 7.5

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process

Record
UBUNTU-CVE-2026-2229
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:7080 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7080
Updated
2026-11-02
OSVALSA-2026:7123 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7123
Updated
2026-11-02
OSVALSA-2026:7350 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7350
Updated
2026-11-02
OSVALSA-2026:7670 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7670
Updated
2026-11-02
OSVALSA-2026:7675 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7675
Updated
2026-11-02
OSVCLSA-2026-1775435423 No score

TuxCare security update for undici (3 CVEs)

TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.29.0-tuxcare.4.

Record
CLSA-2026-1775435423
Updated
2026-11-02
OSVCLSA-2026-1790542220 No score

TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.

Record
CLSA-2026-1790542220
Updated
2026-11-02
OSVCLSA-2026-1791192281 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 6.19.5-tuxcare.3.

Record
CLSA-2026-1791192281
Updated
2026-11-02
OSVCLSA-2026-1791973587 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1791973587
Updated
2026-11-02
OSVCLSA-2026-1792867313 No score

TuxCare security update for undici-types (15 CVEs)

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1792867313
Updated
2026-11-02

Affected products

Show 11 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 6.24.0
6.24.0
undici
npm
 7.0.0 up to 7.24.0
7.24.0
nodejs-docs
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-libs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3.0.1-1.module_el8.10.0+4006+3c416519
3.0.1-1.module_el8.10.0+4006+3c416519
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
Show 161 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
v8-12.4-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+198+8bf605ba
2021.06-6.module_el9.7.0+198+8bf605ba
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
nodejs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
Alpaquita:23
 18.16.0-r0 up to 20.20.2-r0
20.20.2-r0
nodejs
Alpaquita:25
 22.16.0-r1 up to 22.22.2-r0
22.22.2-r0
nodejs
Alpaquita:stream
 22.16.0-r1 up to 24.16.0-r0
24.16.0-r0
nodejs
BellSoft Hardened Containers:23
 18.16.0-r0 up to 20.20.2-r0
20.20.2-r0
nodejs
BellSoft Hardened Containers:25
 22.16.0-r1 up to 22.22.2-r0
22.22.2-r0
nodejs
BellSoft Hardened Containers:stream
 22.16.0-r1 up to 24.16.0-r0
24.16.0-r0
undici
TuxCare:npm
From an advisory covering 3 CVEs
 5.29.0-tuxcare.0 up to 5.29.0-tuxcare.4, plus listed versions
5.29.05.29.0-tuxcare.15.29.0-tuxcare.25.29.0-tuxcare.3
5.29.0-tuxcare.4
undici
TuxCare:npm
From an advisory covering 12 CVEs
 6.19.7-tuxcare.0 up to 6.19.7-tuxcare.1, plus listed versions
6.19.7
6.19.7-tuxcare.1
undici
TuxCare:npm
 6.19.5-tuxcare.0 up to 6.19.5-tuxcare.3, plus listed versions
6.19.56.19.5-tuxcare.16.19.5-tuxcare.2
6.19.5-tuxcare.3
undici
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici-types
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 35 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 7.24.5+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
7.24.5+dfsg+~cs3.2.0-1
nodejs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.el10_1
1:10.9.7-1.22.22.2.1.el10_1
nodejs22
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+24148+847b6786
0:3.0.1-1.module+el8.10.0+24148+847b6786
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+24157+8ddb2461
0:3.0.1-1.module+el9.7.0+24157+8ddb2461
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.2.el10_0
1:10.9.7-1.22.22.2.2.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+24166+51c9666b
0:3.0.3-3.module+el9.7.0+24166+51c9666b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
nodejs24
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.6.0+23473+45664c2d
0:3.0.1-1.module+el9.6.0+23473+45664c2d
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e
1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e
3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e
nodejs22
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs24
Rocky Linux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
undici
Root:npm
 before 6.21.2-aikido.6
6.21.2-aikido.65.29.0-aikido.36.19.2-aikido.76.21.3-aikido.87.5.0-aikido.66.21.3-aikido.96.20.1-aikido.25.29.0-aikido.45.28.5-aikido.15.28.5-aikido.26.20.1-aikido.36.21.3-aikido.105.28.4-aikido.36.19.8-aikido.16.21.1-aikido.26.21.3-aikido.116.19.2-aikido.86.21.2-aikido.76.19.8-aikido.26.21.1-aikido.36.19.2-aikido.96.19.2-aikido.106.19.8-aikido.36.19.8-aikido.45.29.0-aikido.55.28.5-aikido.35.29.0-aikido.65.28.5-aikido.45.28.4-aikido.45.28.4-aikido.57.5.0-aikido.75.28.4-aikido.67.5.0-aikido.86.19.8-aikido.56.21.1-aikido.46.20.1-aikido.46.21.3-aikido.126.21.1-aikido.56.19.8-aikido.6
@rootio/undici
Root:npm
 before 6.21.3-root.io.2
6.21.3-root.io.26.21.3-root.io.36.21.3-root.io.46.21.3-root.io.57.5.0-root.io.16.21.2-root.io.27.5.0-root.io.27.5.0-root.io.36.21.2-root.io.36.21.3-root.io.66.21.2-root.io.47.5.0-root.io.46.21.2-root.io.57.5.0-root.io.56.21.3-root.io.76.19.2-root.io.46.19.2-root.io.56.19.2-root.io.65.29.0-root.io.15.29.0-root.io.26.21.2-root.io.65.29.0-root.io.36.19.2-root.io.76.21.3-root.io.87.5.0-root.io.66.21.3-root.io.96.20.1-root.io.25.29.0-root.io.45.28.5-root.io.15.28.5-root.io.26.20.1-root.io.36.21.3-root.io.105.28.4-root.io.36.19.8-root.io.16.21.1-root.io.26.21.3-root.io.116.19.2-root.io.86.21.2-root.io.76.19.8-root.io.26.21.1-root.io.36.19.2-root.io.96.19.2-root.io.106.19.8-root.io.36.19.8-root.io.45.29.0-root.io.55.28.5-root.io.35.29.0-root.io.65.28.5-root.io.45.28.4-root.io.45.28.4-root.io.57.5.0-root.io.75.28.4-root.io.67.5.0-root.io.86.19.8-root.io.56.21.1-root.io.46.20.1-root.io.46.21.3-root.io.126.21.1-root.io.56.19.8-root.io.6
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2229 is a high vulnerability (CVSS 7.5) in Nodejs Undici, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in undici 6.24.0.

References

Show 160 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open