Every CVE Search/ Get API key

CVE-2026-19534

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

7.5 HighFix available

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Unchanged since Sep 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
CVE-2026-19534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-252
Updated
2026-11-02
EUVDEUVD-2026-71636 7.5

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
EUVD-2026-71636
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rfgv-xxqx-mfg5 7.5

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Impact

The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try/catch, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext ws:// connection subject to a machine-in-the-middle. It affects the default new WebSocket(url) usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.

All releases starting at undici 6.7.0 are affected.

Patches

Upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

Record
GHSA-rfgv-xxqx-mfg5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-252
Updated
2026-11-02
NVD 7.5

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
CVE-2026-19534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-252
Updated
2026-11-02
OSV 7.5

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
CVE-2026-19534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-252
Updated
2026-11-02
OSVDEBIAN-CVE-2026-19534 7.5

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
DEBIAN-CVE-2026-19534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 36 moreShow less
OSVGHSA-rfgv-xxqx-mfg5 7.5

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Impact

The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try/catch, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext ws:// connection subject to a machine-in-the-middle. It affects the default new WebSocket(url) usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.

All releases starting at undici 6.7.0 are affected.

Patches

Upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

Record
GHSA-rfgv-xxqx-mfg5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-252
Updated
2026-11-02
OSVRHSA-2026:66008 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66008
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:66605 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66605
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:71017 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:71017
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:73428 7.5

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:73428
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:73838 7.5

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:73838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74085 7.5

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:74085
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:75864 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:75864
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:75870 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:75870
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:76750 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:76750
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:84589 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:84589
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:84703 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:84703
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:73428 7.5

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10] (JIRA:Rocky Linux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:73428
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:73838 7.5

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:73838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:74085 7.5

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8.10.z] (JIRA:Rocky Linux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:74085
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:75864 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:75864
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:75870 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:75870
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:76750 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:76750
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-19534 7.5

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Record
UBUNTU-CVE-2026-19534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:73428 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:73428
Updated
2026-11-02
OSVALSA-2026:73838 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:73838
Updated
2026-11-02
OSVALSA-2026:74085 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:74085
Updated
2026-11-02
OSVALSA-2026:75864 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:75864
Updated
2026-11-02
OSVALSA-2026:75870 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:75870
Updated
2026-11-02
OSVALSA-2026:76750 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:76750
Updated
2026-11-02
OSVCLSA-2026-1790719646 No score

TuxCare security update for undici (7 CVEs)

TuxCare rebuilt undici to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

Record
CLSA-2026-1790719646
Updated
2026-11-02
OSVCLSA-2026-1790756064 No score

TuxCare security update for undici (6 CVEs)

TuxCare rebuilt undici to address 6 CVEs. Fixed in 7.28.0-tuxcare.3.

Record
CLSA-2026-1790756064
Updated
2026-11-02
OSVCLSA-2026-1790854776 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 6.28.0-tuxcare.1.

Record
CLSA-2026-1790854776
Updated
2026-11-02
OSVCLSA-2026-1790856988 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 6.20.0-tuxcare.1.

Record
CLSA-2026-1790856988
Updated
2026-11-02
OSVCLSA-2026-1790863423 No score

TuxCare security update for undici (2 CVEs)

TuxCare rebuilt undici to address 2 CVEs. Fixed in 6.19.7-tuxcare.2.

Record
CLSA-2026-1790863423
Updated
2026-11-02
OSVCLSA-2026-1790895136 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 6.19.5-tuxcare.1.

Record
CLSA-2026-1790895136
Updated
2026-11-02
OSVCLSA-2026-1791668718 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 6.11.1-tuxcare.5.

Record
CLSA-2026-1791668718
Updated
2026-11-02
OSVCLSA-2026-1792478858 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.

Record
CLSA-2026-1792478858
Updated
2026-11-05
OSVCLSA-2026-1792867308 No score

TuxCare security update for undici-types (7 CVEs)

TuxCare rebuilt undici-types to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

Record
CLSA-2026-1792867308
Updated
2026-11-02
OSVCLSA-2026-1792867311 No score

TuxCare security update for undici-types (1 CVE)

TuxCare rebuilt undici-types to address 1 CVE. Fixed in 6.20.0-tuxcare.1.

Record
CLSA-2026-1792867311
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-19534 No score

CVE-2026-19534 in undici - Patched by Root

Root has patched CVE-2026-19534 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-19534
Updated
2026-11-06

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 6.7.0 up to 6.28.1
6.28.1
undici
npm
 7.0.0 up to 7.29.1
7.29.1
undici
npm
 8.0.0 up to 8.10.2
8.10.2
nodejs24
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 3 CVEs
 before 2:11.19.0-1.24.21.0.1.el10_2
2:11.19.0-1.24.21.0.1.el10_2
nodejs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
Show 200 moreShow less
Affected packages
PackageAffectedFixed
nodejs-devel
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-docs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-libs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-nodemon
AlmaLinux:9
From an advisory covering 3 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
v8-13.6-devel
AlmaLinux:9
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
nodejs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-docs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-libs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960
1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960
v8-13.6-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960
3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960
nodejs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.3.el10_2
1:10.9.8-1.22.23.2.3.el10_2
nodejs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-docs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-libs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.1.14-2.module_el8.10.0+4252+aedd4c30
3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
v8-12.4-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
nodejs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-docs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-libs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-nodemon
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.1.14-2.module_el9.8.0+302+959ebcd4
3.1.14-2.module_el9.8.0+302+959ebcd4
nodejs-packaging
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
v8-12.4-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c
3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c
undici
TuxCare:npm
From an advisory covering 7 CVEs
 7.29.0-tuxcare.0 up to 7.29.0-tuxcare.2, plus listed versions
7.29.07.29.0-tuxcare.1
7.29.0-tuxcare.2
undici
TuxCare:npm
From an advisory covering 6 CVEs
 7.28.0-tuxcare.0 up to 7.28.0-tuxcare.3, plus listed versions
7.28.07.28.0-tuxcare.17.28.0-tuxcare.2
7.28.0-tuxcare.3
undici
TuxCare:npm
 6.28.0-tuxcare.0 up to 6.28.0-tuxcare.1, plus listed versions
6.28.0
6.28.0-tuxcare.1
undici
TuxCare:npm
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.1, plus listed versions
6.20.0
6.20.0-tuxcare.1
undici
TuxCare:npm
From an advisory covering 2 CVEs
 6.19.7-tuxcare.0 up to 6.19.7-tuxcare.2, plus listed versions
6.19.76.19.7-tuxcare.1
6.19.7-tuxcare.2
undici
TuxCare:npm
 6.19.5-tuxcare.0 up to 6.19.5-tuxcare.1, plus listed versions
6.19.5
6.19.5-tuxcare.1
undici
TuxCare:npm
 6.11.1-tuxcare.0 up to 6.11.1-tuxcare.5, plus listed versions
6.11.16.11.1-tuxcare.16.11.1-tuxcare.26.11.1-tuxcare.36.11.1-tuxcare.4
6.11.1-tuxcare.5
undici
TuxCare:npm
From an advisory covering 13 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.2, plus listed versions
7.24.47.24.4-tuxcare.1
7.24.4-tuxcare.2
undici-types
TuxCare:npm
From an advisory covering 7 CVEs
 7.29.0-tuxcare.0 up to 7.29.0-tuxcare.2, plus listed versions
7.29.07.29.0-tuxcare.1
7.29.0-tuxcare.2
undici-types
TuxCare:npm
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.1, plus listed versions
6.20.0
6.20.0-tuxcare.1
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 35 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.10.2+dfsg+~cs3.2.2-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 10 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
8.10.2+dfsg+~cs3.2.2-1
grafana12.4
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:12.4.10-0.2.hum1
0:12.4.10-0.2.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:11.19.1-1.26.8.2.0.1.hum1
0:11.19.1-1.26.8.2.0.1.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:26.8.2-0.1.hum1
0:26.8.2-0.1.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.hum1
0:24.21.0-1.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.hum1
0:11.19.0-1.24.21.0.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.hum1
0:11.19.0-1.24.21.0.1.hum1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 2:11.19.0-1.24.21.0.1.el10_2
2:11.19.0-1.24.21.0.1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006
3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+24711+b610b202
0:3.1.14-2.module+el8.10.0+24711+b610b202
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.3.el10_2
1:10.9.8-1.22.23.2.3.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf
1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf
3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+24709+804d6b5b
0:3.1.14-2.module+el9.8.0+24709+804d6b5b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10
1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10
3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.el10_0
1:10.9.8-1.22.23.2.2.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs24
Rocky Linux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs22
Rocky Linux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-nodemon
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs
Rocky Linux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+40374+17512296
1:22.23.2-2.module+el9.8.0+40374+17512296
nodejs-nodemon
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+40280+057606e8
0:3.1.14-2.module+el9.8.0+40280+057606e8
nodejs-nodemon
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
undici
Root:npm
 before 7.28.0-aikido.2
7.28.0-aikido.26.26.0-aikido.47.24.6-aikido.57.29.0-aikido.26.27.0-aikido.17.24.6-aikido.66.28.0-aikido.16.24.1-aikido.37.28.0-aikido.38.10.0-aikido.27.25.0-aikido.66.21.3-aikido.116.25.0-aikido.26.19.2-aikido.86.19.2-aikido.96.19.2-aikido.108.10.0-aikido.37.25.0-aikido.77.29.0-aikido.37.28.0-aikido.47.24.6-aikido.76.28.0-aikido.26.27.0-aikido.27.29.0-aikido.47.29.0-aikido.57.28.0-aikido.58.10.0-aikido.47.5.0-aikido.86.27.0-aikido.36.28.0-aikido.36.27.0-aikido.47.29.0-aikido.66.26.0-aikido.56.25.0-aikido.36.27.0-aikido.56.21.3-aikido.126.27.0-aikido.67.28.0-aikido.68.10.2-aikido.18.10.2-aikido.28.10.2-aikido.36.28.1-aikido.17.29.1-aikido.16.28.1-aikido.27.29.1-aikido.28.10.2-aikido.4
@rootio/undici
Root:npm
 before 7.28.0-root.io.2
7.28.0-root.io.26.26.0-root.io.47.24.6-root.io.57.29.0-root.io.26.27.0-root.io.17.24.6-root.io.66.28.0-root.io.16.24.1-root.io.37.28.0-root.io.38.10.0-root.io.27.25.0-root.io.66.21.3-root.io.116.25.0-root.io.26.19.2-root.io.86.19.2-root.io.96.19.2-root.io.108.10.0-root.io.37.25.0-root.io.77.29.0-root.io.37.28.0-root.io.47.24.6-root.io.76.28.0-root.io.26.27.0-root.io.27.29.0-root.io.47.29.0-root.io.57.28.0-root.io.58.10.0-root.io.47.5.0-root.io.86.27.0-root.io.36.28.0-root.io.36.27.0-root.io.47.29.0-root.io.66.26.0-root.io.56.25.0-root.io.36.27.0-root.io.56.21.3-root.io.126.27.0-root.io.67.28.0-root.io.68.10.2-root.io.18.10.2-root.io.28.10.2-root.io.36.28.1-root.io.17.29.1-root.io.16.28.1-root.io.27.29.1-root.io.28.10.2-root.io.4
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected
affectedOSV
affected, factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-19534 is a high vulnerability (CVSS 7.5) in Nodejs Undici, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in undici 6.28.1.

References

Show 126 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open