Every CVE Search/ Get API key

CVE-2026-85152

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

7.4 HighFix available

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.16%Unchanged since Sep 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
CVE-2026-85152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
EUVDEUVD-2026-71474 7.4

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
EUVD-2026-71474
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vp8m-p9jh-q5pm 7.4

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Impact

When interceptors.cache() or interceptors.deduplicate() is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together.

An attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers match. This allows cross-origin information disclosure and persistent cache poisoning, including chains such as JWKS cache poisoning where a token signed with an attacker-held key is accepted as belonging to a trusted issuer.

Applications that share interceptors.cache() or interceptors.deduplicate() state across origins are affected. An Agent is not affected, because its dispatch options include the request origin.

This was introduced in undici 8.10.0 and affects 8.10.0 and 8.10.1.

Patches

Upgrade to undici v8.10.2.

Workarounds

Use a separate cache store and a separate interceptor instance for each origin, and do not share them across origins.

Record
GHSA-vp8m-p9jh-q5pm
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
NVD 7.4

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
CVE-2026-85152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
OSV 7.4

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
CVE-2026-85152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
OSVDEBIAN-CVE-2026-85152 7.4

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
DEBIAN-CVE-2026-85152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 16 moreShow less
OSVGHSA-vp8m-p9jh-q5pm 7.4

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Impact

When interceptors.cache() or interceptors.deduplicate() is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together.

An attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers match. This allows cross-origin information disclosure and persistent cache poisoning, including chains such as JWKS cache poisoning where a token signed with an attacker-held key is accepted as belonging to a trusted issuer.

Applications that share interceptors.cache() or interceptors.deduplicate() state across origins are affected. An Agent is not affected, because its dispatch options include the request origin.

This was introduced in undici 8.10.0 and affects 8.10.0 and 8.10.1.

Patches

Upgrade to undici v8.10.2.

Workarounds

Use a separate cache store and a separate interceptor instance for each origin, and do not share them across origins.

Record
GHSA-vp8m-p9jh-q5pm
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
OSVRHSA-2026:54389 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:54389
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54438 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:54438
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:63782 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:63782
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:73428 7.5

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:73428
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:73838 7.5

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:73838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74085 7.5

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:74085
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:73428 7.5

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10] (JIRA:Rocky Linux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:73428
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:73838 7.5

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:73838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:74085 7.5

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8.10.z] (JIRA:Rocky Linux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:74085
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-85152 7.4

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Record
UBUNTU-CVE-2026-85152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:73428 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:73428
Updated
2026-11-02
OSVALSA-2026:73838 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:73838
Updated
2026-11-02
OSVALSA-2026:74085 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
  • undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:74085
Updated
2026-11-02
OSVopenSUSE-SU-2026:22111-1 No score

Security update for pi-coding-agent

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

  • Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

    • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
    • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
    • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
    • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
    • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

  • Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

    • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
    • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
    • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
    • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
    • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
    • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
    • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
    • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…
Record
openSUSE-SU-2026:22111-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-85152 No score

CVE-2026-85152 in undici - Patched by Root

Root has patched CVE-2026-85152 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-85152
Updated
2026-11-06

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 8.10.0 up to 8.10.2
8.10.2
nodejs24
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 3 CVEs
 before 2:11.19.0-1.24.21.0.1.el10_2
2:11.19.0-1.24.21.0.1.el10_2
nodejs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-devel
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-docs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
Show 90 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-libs
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el9.8.0+321+1555b6a2
1:24.21.0-1.module_el9.8.0+321+1555b6a2
nodejs-nodemon
AlmaLinux:9
From an advisory covering 3 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
v8-13.6-devel
AlmaLinux:9
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
nodejs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-docs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-libs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module_el8.10.0+4292+21afb960
1:24.21.0-1.module_el8.10.0+4292+21afb960
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960
1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960
v8-13.6-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960
3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 35 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.10.2+dfsg+~cs3.2.2-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 10 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
8.10.2+dfsg+~cs3.2.2-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.19.0-1.26.7.0.1.5.2.hum1
0:11.19.0-1.26.7.0.1.5.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
v8-14.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:14.6.202.34-1.26.7.0.1.5.2.hum1
0:14.6.202.34-1.26.7.0.1.5.2.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:11.16.0-1.24.18.1.0.2.2.hum1
0:11.16.0-1.24.18.1.0.2.2.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:24.18.1-0.2.2.hum1
0:24.18.1-0.2.2.hum1
grafana12.4
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:12.4.9-0.6.hum1
0:12.4.9-0.6.hum1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 2:11.19.0-1.24.21.0.1.el10_2
2:11.19.0-1.24.21.0.1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el9.8.0+24924+cd677006
1:24.21.0-1.module+el9.8.0+24924+cd677006
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006
3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:24.21.0-1.module+el8.10.0+24927+ed3d907a
1:24.21.0-1.module+el8.10.0+24927+ed3d907a
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+24711+b610b202
0:3.1.14-2.module+el8.10.0+24711+b610b202
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a
nodejs24
Rocky Linux:10
From an advisory covering 3 CVEs
 before 1:24.21.0-1.el10_2
1:24.21.0-1.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
undici
Root:npm
 before 8.10.0-aikido.1
8.10.0-aikido.18.10.0-aikido.28.10.0-aikido.38.10.0-aikido.48.10.2-aikido.18.10.2-aikido.28.10.2-aikido.38.10.2-aikido.4
@rootio/undici
Root:npm
 before 8.10.0-root.io.1
8.10.0-root.io.18.10.0-root.io.28.10.0-root.io.38.10.0-root.io.48.10.2-root.io.18.10.2-root.io.28.10.2-root.io.38.10.2-root.io.4
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known
pi-coding-agent
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 1.0.4-bp160.1.1
1.0.4-bp160.1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-85152 is a high vulnerability (CVSS 7.4) in Nodejs Undici, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in undici 8.10.2.

References

Show 124 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open