Every CVE Search/ Get API key

CVE-2026-9697

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

7.4 HighFix available

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.46%Up 0.3 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
CVE-2026-9697
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295, CWE-295
Updated
2026-11-02
EUVDEUVD-2026-37763 7.4

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
EUVD-2026-37763
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vmh5-mc38-953g 7.4

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact

undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches

Upgrade to undici v7.28.0 or v8.5.0.

Workarounds

No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
GHSA-vmh5-mc38-953g
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 7.4

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
CVE-2026-9697
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 7.4

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
CVE-2026-9697
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVDEBIAN-CVE-2026-9697 7.4

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
DEBIAN-CVE-2026-9697
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 18 moreShow less
OSVGHSA-vmh5-mc38-953g 7.4

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact

undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches

Upgrade to undici v7.28.0 or v8.5.0.

Workarounds

No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
GHSA-vmh5-mc38-953g
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVRHSA-2026:22380 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22380
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:22934 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22934
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:35841 8.1

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35891 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:39868 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:7378 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7378
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:35841 8.1

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35891 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:39868 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9697 7.4

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
UBUNTU-CVE-2026-9697
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:35841 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35841
Updated
2026-11-02
OSVALSA-2026:35891 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35891
Updated
2026-11-02
OSVALSA-2026:39868 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:39868
Updated
2026-11-02
OSVAZL-91227 No score

CVE-2026-9697 affecting package nodejs for versions less than 24.17.0-1

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.

Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

Record
AZL-91227
Updated
2026-11-02
OSVCLSA-2026-1792478858 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.

Record
CLSA-2026-1792478858
Updated
2026-11-05
OSVROOT-APP-NPM-CVE-2026-9697 No score

CVE-2026-9697 in undici - Patched by Root

Root has patched CVE-2026-9697 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-9697
Updated
2026-11-05

Affected products

Show 13 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 7.23.0 up to 7.28.0
7.28.0
undici
npm
 8.0.0 up to 8.5.0
8.5.0
nodejs24
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
Show 117 moreShow less
Affected packages
PackageAffectedFixed
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
nodejs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-docs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-libs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-nodemon
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
v8-13.6-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
nodejs
Azure Linux:3
 before 24.17.0-1
24.17.0-1
undici
TuxCare:npm
From an advisory covering 13 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.2, plus listed versions
7.24.47.24.4-tuxcare.1
7.24.4-tuxcare.2
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.5.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 6 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
8.5.0+dfsg+~cs3.2.0-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:11.16.0-1.26.3.0.1.2.hum1
0:11.16.0-1.26.3.0.1.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.8.0+24355+35d95b59
0:3.0.3-3.module+el9.8.0+24355+35d95b59
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
nodejs24
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.16.0-1.24.18.0.0.3.hum1
0:11.16.0-1.24.18.0.0.3.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:13.6.233.17-1.24.18.0.0.3.hum1
0:13.6.233.17-1.24.18.0.0.3.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
nodejs25
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-docs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-npm
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:11.12.1-1.25.9.0.1.1.hum1
0:11.12.1-1.25.9.0.1.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs24
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs
Rocky Linux:8
From an advisory covering 15 CVEs
 before 1:24.18.0-1.module+el8.10.0+40252+a58646bc
1:24.18.0-1.module+el8.10.0+40252+a58646bc
nodejs-nodemon
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
undici
Root:npm
 before 7.24.6-aikido.4
7.24.6-aikido.47.24.6-aikido.17.24.6-aikido.27.24.5-aikido.17.25.0-aikido.17.26.0-aikido.17.24.5-aikido.27.26.0-aikido.27.25.0-aikido.27.24.6-aikido.37.26.0-aikido.37.25.0-aikido.37.24.5-aikido.37.24.5-aikido.47.25.0-aikido.47.24.6-aikido.57.24.6-aikido.67.25.0-aikido.57.25.0-aikido.67.25.0-aikido.77.24.6-aikido.77.28.0-aikido.18.5.0-aikido.17.28.0-aikido.27.28.0-aikido.37.28.0-aikido.47.28.0-aikido.57.28.0-aikido.6
@rootio/undici
Root:npm
 before 7.24.6-root.io.4
7.24.6-root.io.47.24.6-root.io.17.24.6-root.io.27.24.5-root.io.17.25.0-root.io.17.26.0-root.io.17.24.5-root.io.27.26.0-root.io.27.25.0-root.io.27.24.6-root.io.37.26.0-root.io.37.25.0-root.io.37.24.5-root.io.37.24.5-root.io.47.25.0-root.io.47.24.6-root.io.57.24.6-root.io.67.25.0-root.io.57.25.0-root.io.67.25.0-root.io.77.24.6-root.io.77.28.0-root.io.18.5.0-root.io.17.28.0-root.io.27.28.0-root.io.37.28.0-root.io.47.28.0-root.io.57.28.0-root.io.6
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9697 is a high vulnerability (CVSS 7.4) in Nodejs Undici, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in undici 7.28.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 36 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open