Every CVE Search/ Get API key

CVE-2026-9678

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

5.9 MediumFix available

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.2 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
CVE-2026-9678
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-524
Updated
2026-11-02
EUVDEUVD-2026-37766 5.9

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
EUVD-2026-37766
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pr7r-676h-xcf6 5.9

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Impact

Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches

Upgrade to undici v7.28.0 or v8.5.0.

Workarounds

If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
GHSA-pr7r-676h-xcf6
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-524
Updated
2026-11-02
NVD 5.9

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
CVE-2026-9678
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-524
Updated
2026-11-02
OSV 5.9

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
CVE-2026-9678
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-524
Updated
2026-11-02
OSVDEBIAN-CVE-2026-9678 5.9

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
DEBIAN-CVE-2026-9678
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 29 moreShow less
OSVGHSA-pr7r-676h-xcf6 5.9

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Impact

Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches

Upgrade to undici v7.28.0 or v8.5.0.

Workarounds

If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
GHSA-pr7r-676h-xcf6
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-524
Updated
2026-11-02
OSVRHSA-2026:22380 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22380
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:35841 8.1

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35842 8.1

Red Hat Security Advisory: nodejs22 security, bug fix, and enhancement update

Record
RHSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35891 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35892 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:39868 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:41947 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:7378 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7378
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:35841 8.1

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35842 8.1

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35891 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35892 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:39868 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:41947 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9678 5.9

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Record
UBUNTU-CVE-2026-9678
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:35841 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35841
Updated
2026-11-02
OSVALSA-2026:35842 No score

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35842
Updated
2026-11-02
OSVALSA-2026:35891 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35891
Updated
2026-11-02
OSVALSA-2026:35892 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35892
Updated
2026-11-02
OSVALSA-2026:39868 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:39868
Updated
2026-11-02
OSVALSA-2026:41947 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-8] (JIRA:AlmaLinux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41947
Updated
2026-11-02
OSVCLSA-2026-1793015471 No score

TuxCare security update for undici (2 CVEs)

TuxCare rebuilt undici to address 2 CVEs. Fixed in 7.24.4-tuxcare.3.

Record
CLSA-2026-1793015471
Updated
2026-11-02
OSVopenSUSE-SU-2026:11121-1 No score

corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11121-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21236-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
openSUSE-SU-2026:21236-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-9678 No score

CVE-2026-9678 in undici - Patched by Root

Root has patched CVE-2026-9678 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-9678
Updated
2026-11-05
OSVSUSE-SU-2026:22565-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
SUSE-SU-2026:22565-1
Updated
2026-11-02
OSVSUSE-SU-2026:2633-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to 24.17.0:

  • CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2633-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 7.0.0 up to 7.28.0
7.28.0
undici
npm
 8.0.0 up to 8.5.0
8.5.0
nodejs24
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
Show 184 moreShow less
Affected packages
PackageAffectedFixed
nodejs-docs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
nodejs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-devel
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-docs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-libs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-nodemon
AlmaLinux:9
From an advisory covering 16 CVEs
 before 3.0.1-1.module_el9.7.0+208+fb06c0ab
3.0.1-1.module_el9.7.0+208+fb06c0ab
nodejs-packaging
AlmaLinux:9
From an advisory covering 16 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 16 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
v8-12.4-devel
AlmaLinux:9
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
nodejs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-docs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-libs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-nodemon
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
v8-13.6-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
nodejs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-devel
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-docs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-libs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-nodemon
AlmaLinux:8
From an advisory covering 16 CVEs
 before 3.0.1-1.module_el8.10.0+3956+47c9ee9f
3.0.1-1.module_el8.10.0+3956+47c9ee9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 16 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 16 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
v8-12.4-devel
AlmaLinux:8
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
undici
TuxCare:npm
From an advisory covering 2 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.3, plus listed versions
7.24.47.24.4-tuxcare.17.24.4-tuxcare.2
7.24.4-tuxcare.3
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.5.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 6 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
8.5.0+dfsg+~cs3.2.0-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:11.16.0-1.26.3.0.1.2.hum1
0:11.16.0-1.26.3.0.1.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.8.0+24355+35d95b59
0:3.0.3-3.module+el9.8.0+24355+35d95b59
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:3.0.1-1.module+el9.8.0+24156+bb41d456
0:3.0.1-1.module+el9.8.0+24156+bb41d456
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
nodejs24
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.16.0-1.24.18.0.0.3.hum1
0:11.16.0-1.24.18.0.0.3.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:13.6.233.17-1.24.18.0.0.3.hum1
0:13.6.233.17-1.24.18.0.0.3.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:3.0.1-1.module+el8.10.0+24500+8eb51621
0:3.0.1-1.module+el8.10.0+24500+8eb51621
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
nodejs25
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-docs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-npm
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:11.12.1-1.25.9.0.1.1.hum1
0:11.12.1-1.25.9.0.1.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs24
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs22
Rocky Linux:10
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40165+d075e3f2
0:3.0.1-1.module+el9.7.0+40165+d075e3f2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40153+4d595597
0:3.0.1-1.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs
Rocky Linux:8
From an advisory covering 15 CVEs
 before 1:24.18.0-1.module+el8.10.0+40252+a58646bc
1:24.18.0-1.module+el8.10.0+40252+a58646bc
nodejs-nodemon
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
undici
Root:npm
 before 7.24.6-aikido.4
7.24.6-aikido.47.24.6-aikido.37.26.0-aikido.37.25.0-aikido.37.24.5-aikido.37.24.5-aikido.47.25.0-aikido.47.24.6-aikido.57.24.6-aikido.67.25.0-aikido.57.25.0-aikido.67.25.0-aikido.77.24.6-aikido.77.28.0-aikido.18.5.0-aikido.17.28.0-aikido.27.28.0-aikido.37.28.0-aikido.47.28.0-aikido.57.28.0-aikido.6
@rootio/undici
Root:npm
 before 7.24.6-root.io.4
7.24.6-root.io.47.24.6-root.io.37.26.0-root.io.37.25.0-root.io.37.24.5-root.io.37.24.5-root.io.47.25.0-root.io.47.24.6-root.io.57.24.6-root.io.67.25.0-root.io.57.25.0-root.io.67.25.0-root.io.77.24.6-root.io.77.28.0-root.io.18.5.0-root.io.17.28.0-root.io.27.28.0-root.io.37.28.0-root.io.47.28.0-root.io.57.28.0-root.io.6
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 21 CVEs
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known
nodejs24
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 24.17.0-1.1
24.17.0-1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9678 is a medium vulnerability (CVSS 5.9) in Nodejs Undici, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in undici 7.28.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 66 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open