Every CVE Search/ Get API key

CVE-2026-9679

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

5.9 MediumFix available

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.26%Up 0.1 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
CVE-2026-9679
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-93
Updated
2026-11-02
EUVDEUVD-2026-37764 5.9

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
EUVD-2026-37764
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p88m-4jfj-68fv 5.9

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Impact

undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via #3789.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
GHSA-p88m-4jfj-68fv
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-93
Updated
2026-11-02
NVD 5.9

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
CVE-2026-9679
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-93
Updated
2026-11-02
OSV 5.9

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
CVE-2026-9679
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2026-9679 5.9

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
DEBIAN-CVE-2026-9679
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 21 moreShow less
OSVGHSA-p88m-4jfj-68fv 5.9

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Impact

undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via #3789.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
GHSA-p88m-4jfj-68fv
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-93
Updated
2026-11-02
OSVRHSA-2026:38009 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:38009
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:38236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9679 5.9

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
UBUNTU-CVE-2026-9679
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-91188 No score

CVE-2026-9679 affecting package nodejs for versions less than 24.18.1-1

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.

Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.

Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.

This was introduced in undici 7.0.0 via PR #3789.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Record
AZL-91188
Updated
2026-11-02
OSVCLSA-2026-1791973587 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1791973587
Updated
2026-11-02
OSVCLSA-2026-1792867313 No score

TuxCare security update for undici-types (15 CVEs)

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1792867313
Updated
2026-11-02
OSVCLSA-2026-1793015471 No score

TuxCare security update for undici (2 CVEs)

TuxCare rebuilt undici to address 2 CVEs. Fixed in 7.24.4-tuxcare.3.

Record
CLSA-2026-1793015471
Updated
2026-11-02
OSVopenSUSE-SU-2026:11121-1 No score

corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11121-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21058-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
openSUSE-SU-2026:21058-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21236-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
openSUSE-SU-2026:21236-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-9679 No score

CVE-2026-9679 in undici - Patched by Root

Root has patched CVE-2026-9679 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-9679
Updated
2026-11-05
OSVSUSE-SU-2026:22368-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:22368-1
Updated
2026-11-02
OSVSUSE-SU-2026:22565-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
SUSE-SU-2026:22565-1
Updated
2026-11-02
OSVSUSE-SU-2026:2633-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to 24.17.0:

  • CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2633-1
Updated
2026-11-02
OSVSUSE-SU-2026:2647-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2647-1
Updated
2026-11-02
OSVSUSE-SU-2026:2695-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

  • CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
  • CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
  • CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
  • CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
  • CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
  • CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
  • CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
  • CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
  • CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
  • CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
  • CVE-2026-48937: http2: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).
  • CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).
  • CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec ( bsc#1266318).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
Record
SUSE-SU-2026:2695-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02
OSVSUSE-SU-2026:4248-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4248-1
Updated
2026-11-02
OSVSUSE-SU-2026:4261-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4261-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 6.27.0
6.27.0
undici
npm
 7.0.0 up to 7.28.0
7.28.0
undici
npm
 8.0.0 up to 8.5.0
8.5.0
nodejs
Azure Linux:3
 before 24.18.1-1
24.18.1-1
undici
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici-types
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici
TuxCare:npm
From an advisory covering 2 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.3, plus listed versions
7.24.47.24.4-tuxcare.17.24.4-tuxcare.2
7.24.4-tuxcare.3
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.5.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 6 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
8.5.0+dfsg+~cs3.2.0-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
Show 49 moreShow less
Affected packages
PackageAffectedFixed
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.17.0-1.26.5.0.1.3.hum1
0:11.17.0-1.26.5.0.1.3.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.5.0-1.3.hum1
0:26.5.0-1.3.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.16.0-1.24.18.0.0.3.hum1
0:11.16.0-1.24.18.0.0.3.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:13.6.233.17-1.24.18.0.0.3.hum1
0:13.6.233.17-1.24.18.0.0.3.hum1
undici
Root:npm
 before 7.24.6-aikido.4
7.24.6-aikido.46.26.0-aikido.36.25.0-aikido.16.24.1-aikido.27.24.6-aikido.36.26.0-aikido.26.20.1-aikido.36.21.3-aikido.107.26.0-aikido.37.25.0-aikido.37.24.5-aikido.37.24.5-aikido.47.25.0-aikido.46.26.0-aikido.47.24.6-aikido.57.24.6-aikido.66.24.1-aikido.37.25.0-aikido.57.25.0-aikido.66.21.3-aikido.116.21.0-aikido.16.25.0-aikido.26.21.2-aikido.76.19.2-aikido.96.21.0-aikido.26.19.2-aikido.106.21.0-aikido.36.19.8-aikido.36.19.8-aikido.47.25.0-aikido.77.24.6-aikido.76.26.0-aikido.56.19.8-aikido.56.25.0-aikido.36.20.1-aikido.46.21.3-aikido.126.19.8-aikido.67.28.0-aikido.18.5.0-aikido.17.28.0-aikido.26.27.0-aikido.17.28.0-aikido.37.28.0-aikido.46.27.0-aikido.27.28.0-aikido.56.27.0-aikido.36.27.0-aikido.46.27.0-aikido.56.27.0-aikido.67.28.0-aikido.6
@rootio/undici
Root:npm
 before 7.24.6-root.io.4
7.24.6-root.io.46.26.0-root.io.36.25.0-root.io.16.24.1-root.io.27.24.6-root.io.36.26.0-root.io.26.20.1-root.io.36.21.3-root.io.107.26.0-root.io.37.25.0-root.io.37.24.5-root.io.37.24.5-root.io.47.25.0-root.io.46.26.0-root.io.47.24.6-root.io.57.24.6-root.io.66.24.1-root.io.37.25.0-root.io.57.25.0-root.io.66.21.3-root.io.116.21.0-root.io.16.25.0-root.io.26.21.2-root.io.76.19.2-root.io.96.21.0-root.io.26.19.2-root.io.106.21.0-root.io.36.19.8-root.io.36.19.8-root.io.47.25.0-root.io.77.24.6-root.io.76.26.0-root.io.56.19.8-root.io.56.25.0-root.io.36.20.1-root.io.46.21.3-root.io.126.19.8-root.io.67.28.0-root.io.18.5.0-root.io.17.28.0-root.io.26.27.0-root.io.17.28.0-root.io.37.28.0-root.io.46.27.0-root.io.27.28.0-root.io.56.27.0-root.io.36.27.0-root.io.46.27.0-root.io.56.27.0-root.io.67.28.0-root.io.6
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 21 CVEs
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 19 CVEs
 before 22.23.0-150700.3.12.1
22.23.0-150700.3.12.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs18
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known
nodejs24
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 24.17.0-1.1
24.17.0-1.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9679 is a medium vulnerability (CVSS 5.9) in Nodejs Undici, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in undici 6.27.0.

References

Show 173 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open