Every CVE Search/ Get API key

CVE-2026-6734

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

7.5 HighFix available

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.34%Up 0.2 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
CVE-2026-6734
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-346, CWE-940
Updated
2026-11-02
EUVDEUVD-2026-37760 7.5

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
EUVD-2026-37760
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hm92-r4w5-c3mj 7.5

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact

When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0.

Patches

Upgrade to undici v7.28.0 or v8.2.0

Workarounds

Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
GHSA-hm92-r4w5-c3mj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
NVD 7.5

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
CVE-2026-6734
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-346, CWE-940
Updated
2026-11-02
OSV 7.5

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.

Patches: Upgrade to undici v7.26.0 or v8.2.0.

Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
CVE-2026-6734
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
OSVDEBIAN-CVE-2026-6734 8.8

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
DEBIAN-CVE-2026-6734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 17 moreShow less
OSVGHSA-hm92-r4w5-c3mj 7.5

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact

When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.

This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.

Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.

This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0.

Patches

Upgrade to undici v7.28.0 or v8.2.0

Workarounds

Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
GHSA-hm92-r4w5-c3mj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
OSVRHSA-2026:22380 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22380
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:22934 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22934
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:35841 8.1

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35891 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:39868 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:7378 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7378
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:35841 8.1

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35891 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:39868 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6734 7.5

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Record
UBUNTU-CVE-2026-6734
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:35841 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35841
Updated
2026-11-02
OSVALSA-2026:35891 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35891
Updated
2026-11-02
OSVALSA-2026:39868 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:39868
Updated
2026-11-02
OSVCLSA-2026-1792478858 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.

Record
CLSA-2026-1792478858
Updated
2026-11-05
OSVROOT-APP-NPM-CVE-2026-6734 No score

CVE-2026-6734 in undici - Patched by Root

Root has patched CVE-2026-6734 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-6734
Updated
2026-11-05

Affected products

Show 11 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 7.23.0 up to 7.28.0
7.28.0
undici
npm
 8.0.0 up to 8.2.0
8.2.0
nodejs24
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
Show 116 moreShow less
Affected packages
PackageAffectedFixed
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
nodejs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-docs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-libs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-nodemon
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
v8-13.6-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
undici
TuxCare:npm
From an advisory covering 13 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.2, plus listed versions
7.24.47.24.4-tuxcare.1
7.24.4-tuxcare.2
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.5.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 6 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
8.5.0+dfsg+~cs3.2.0-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:11.16.0-1.26.3.0.1.2.hum1
0:11.16.0-1.26.3.0.1.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.8.0+24355+35d95b59
0:3.0.3-3.module+el9.8.0+24355+35d95b59
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
nodejs24
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.16.0-1.24.18.0.0.3.hum1
0:11.16.0-1.24.18.0.0.3.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:13.6.233.17-1.24.18.0.0.3.hum1
0:13.6.233.17-1.24.18.0.0.3.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
nodejs25
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-docs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-npm
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:11.12.1-1.25.9.0.1.1.hum1
0:11.12.1-1.25.9.0.1.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs24
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs
Rocky Linux:8
From an advisory covering 15 CVEs
 before 1:24.18.0-1.module+el8.10.0+40252+a58646bc
1:24.18.0-1.module+el8.10.0+40252+a58646bc
nodejs-nodemon
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
undici
Root:npm
 before 7.24.6-aikido.4
7.24.6-aikido.47.24.6-aikido.17.24.6-aikido.27.24.5-aikido.17.25.0-aikido.17.26.0-aikido.17.24.5-aikido.27.26.0-aikido.27.25.0-aikido.27.24.6-aikido.37.26.0-aikido.37.25.0-aikido.37.24.5-aikido.37.24.5-aikido.47.25.0-aikido.47.24.6-aikido.57.24.6-aikido.67.25.0-aikido.57.25.0-aikido.67.25.0-aikido.77.24.6-aikido.77.28.0-aikido.17.28.0-aikido.27.28.0-aikido.37.28.0-aikido.47.28.0-aikido.57.28.0-aikido.6
@rootio/undici
Root:npm
 before 7.24.6-root.io.4
7.24.6-root.io.47.24.6-root.io.17.24.6-root.io.27.24.5-root.io.17.25.0-root.io.17.26.0-root.io.17.24.5-root.io.27.26.0-root.io.27.25.0-root.io.27.24.6-root.io.37.26.0-root.io.37.25.0-root.io.37.24.5-root.io.37.24.5-root.io.47.25.0-root.io.47.24.6-root.io.57.24.6-root.io.67.25.0-root.io.57.25.0-root.io.67.25.0-root.io.77.24.6-root.io.77.28.0-root.io.17.28.0-root.io.27.28.0-root.io.37.28.0-root.io.47.28.0-root.io.57.28.0-root.io.6
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6734 is a high vulnerability (CVSS 7.5) in Nodejs Undici, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in undici 7.28.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 35 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open