Every CVE Search/ Get API key

CVE-2026-1525

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

6.5 MediumFix available

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.56%Up 0.5 points since Mar 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Record
CVE-2026-1525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-11685 6.5

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Record
EUVD-2026-11685
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-2mjp-6q6p-2qxm 6.5

Undici has an HTTP Request/Response Smuggling issue

Impact

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

If upgrading is not immediately possible:

  1. Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici
  2. Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key
  3. Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates
Record
GHSA-2mjp-6q6p-2qxm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-444
Updated
2026-11-02
NVD 6.5

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Record
CVE-2026-1525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-444
Updated
2026-11-02
OSVBELL-CVE-2026-1525 9.8
Record
BELL-CVE-2026-1525
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.5

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Record
CVE-2026-1525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-444
Updated
2026-11-02
Show 31 moreShow less
OSVDEBIAN-CVE-2026-1525 9.8

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Record
DEBIAN-CVE-2026-1525
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-2mjp-6q6p-2qxm 6.5

Undici has an HTTP Request/Response Smuggling issue

Impact

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization

Potential consequences:

  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

If upgrading is not immediately possible:

  1. Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici
  2. Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key
  3. Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates
Record
GHSA-2mjp-6q6p-2qxm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-444
Updated
2026-11-02
OSVRHSA-2026:7080 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7123 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7302 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7310 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7310
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7350 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7670 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7675 7.5

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7983 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7983
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7080 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7123 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7302 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7350 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7670 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7675 7.5

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-1525 6.5

CVE-2026-1525 in undici - Patched by Root

Root has patched CVE-2026-1525 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-1525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-1525 6.5

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Record
UBUNTU-CVE-2026-1525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:7080 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7080
Updated
2026-11-02
OSVALSA-2026:7123 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7123
Updated
2026-11-02
OSVALSA-2026:7350 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7350
Updated
2026-11-02
OSVALSA-2026:7670 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7670
Updated
2026-11-02
OSVALSA-2026:7675 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7675
Updated
2026-11-02
OSVCLSA-2026-1775435423 No score

TuxCare security update for undici (3 CVEs)

TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.29.0-tuxcare.4.

Record
CLSA-2026-1775435423
Updated
2026-11-02
OSVCLSA-2026-1779065182 No score

TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.4.

Record
CLSA-2026-1779065182
Updated
2026-11-02
OSVCLSA-2026-1785204338 No score

TuxCare security update for undici (6 CVEs)

TuxCare rebuilt undici to address 6 CVEs. Fixed in 6.11.1-tuxcare.4.

Record
CLSA-2026-1785204338
Updated
2026-11-02
OSVCLSA-2026-1788560495 No score

TuxCare security update for undici (14 CVEs)

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

Record
CLSA-2026-1788560495
Updated
2026-11-02
OSVCLSA-2026-1790542220 No score

TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.

Record
CLSA-2026-1790542220
Updated
2026-11-02
OSVCLSA-2026-1791028079 No score

TuxCare security update for undici (11 CVEs)

TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.

Record
CLSA-2026-1791028079
Updated
2026-11-02
OSVCLSA-2026-1791973587 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1791973587
Updated
2026-11-02
OSVCLSA-2026-1792867313 No score

TuxCare security update for undici-types (15 CVEs)

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1792867313
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 6.24.0
6.24.0
undici
npm
 7.0.0 up to 7.24.0
7.24.0
nodejs-docs
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-libs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3.0.1-1.module_el8.10.0+4006+3c416519
3.0.1-1.module_el8.10.0+4006+3c416519
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
Show 163 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
v8-12.4-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+198+8bf605ba
2021.06-6.module_el9.7.0+198+8bf605ba
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
nodejs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
Alpaquita:23
 18.16.0-r0 up to 20.20.2-r0
20.20.2-r0
nodejs
Alpaquita:25
 22.16.0-r1 up to 22.22.2-r0
22.22.2-r0
nodejs
Alpaquita:stream
 22.16.0-r1 up to 24.16.0-r0
24.16.0-r0
nodejs
BellSoft Hardened Containers:23
 18.16.0-r0 up to 20.20.2-r0
20.20.2-r0
nodejs
BellSoft Hardened Containers:25
 22.16.0-r1 up to 22.22.2-r0
22.22.2-r0
nodejs
BellSoft Hardened Containers:stream
 22.16.0-r1 up to 24.16.0-r0
24.16.0-r0
undici
TuxCare:npm
From an advisory covering 3 CVEs
 5.29.0-tuxcare.0 up to 5.29.0-tuxcare.4, plus listed versions
5.29.05.29.0-tuxcare.15.29.0-tuxcare.25.29.0-tuxcare.3
5.29.0-tuxcare.4
undici
TuxCare:npm
 5.28.5-tuxcare.0 up to 5.28.5-tuxcare.4, plus listed versions
5.28.55.28.5-tuxcare.15.28.5-tuxcare.25.28.5-tuxcare.3
5.28.5-tuxcare.4
undici
TuxCare:npm
From an advisory covering 6 CVEs
 6.11.1-tuxcare.0 up to 6.11.1-tuxcare.4, plus listed versions
6.11.16.11.1-tuxcare.16.11.1-tuxcare.26.11.1-tuxcare.3
6.11.1-tuxcare.4
undici
TuxCare:npm
From an advisory covering 14 CVEs
 5.5.1-tuxcare.0 up to 5.5.1-tuxcare.1, plus listed versions
5.5.1
5.5.1-tuxcare.1
undici
TuxCare:npm
From an advisory covering 12 CVEs
 6.19.7-tuxcare.0 up to 6.19.7-tuxcare.1, plus listed versions
6.19.7
6.19.7-tuxcare.1
undici
TuxCare:npm
From an advisory covering 11 CVEs
 6.19.5-tuxcare.0 up to 6.19.5-tuxcare.2, plus listed versions
6.19.56.19.5-tuxcare.1
6.19.5-tuxcare.2
undici
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici-types
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 7.24.5+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
7.24.5+dfsg+~cs3.2.0-1
nodejs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.el10_1
1:10.9.7-1.22.22.2.1.el10_1
nodejs22
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+24148+847b6786
0:3.0.1-1.module+el8.10.0+24148+847b6786
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+24157+8ddb2461
0:3.0.1-1.module+el9.7.0+24157+8ddb2461
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.2.el10_0
1:10.9.7-1.22.22.2.2.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 1:22.22.2-2.el10_0
1:22.22.2-2.el10_0
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+24166+51c9666b
0:3.0.3-3.module+el9.7.0+24166+51c9666b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
nodejs24
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.6.0+24196+39669d4e
1:22.22.2-1.module+el9.6.0+24196+39669d4e
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.6.0+23473+45664c2d
0:3.0.1-1.module+el9.6.0+23473+45664c2d
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e
1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e
3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e
nodejs22
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs24
Rocky Linux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
undici
Root:npm
 before 6.21.2-aikido.6
6.21.2-aikido.65.29.0-aikido.36.19.2-aikido.76.21.3-aikido.87.5.0-aikido.66.20.1-aikido.16.21.3-aikido.96.20.1-aikido.25.29.0-aikido.45.28.5-aikido.15.28.5-aikido.26.20.1-aikido.36.21.3-aikido.106.21.3-aikido.116.19.2-aikido.86.21.2-aikido.76.19.2-aikido.96.19.2-aikido.105.29.0-aikido.55.28.5-aikido.35.29.0-aikido.65.28.5-aikido.47.5.0-aikido.77.5.0-aikido.86.20.1-aikido.46.21.3-aikido.12
@rootio/undici
Root:npm
 before 6.21.3-root.io.3
6.21.3-root.io.36.21.3-root.io.46.21.3-root.io.57.5.0-root.io.36.21.2-root.io.36.21.3-root.io.66.21.2-root.io.47.5.0-root.io.46.21.2-root.io.57.5.0-root.io.56.21.3-root.io.76.19.2-root.io.65.29.0-root.io.15.29.0-root.io.26.21.2-root.io.65.29.0-root.io.36.19.2-root.io.76.21.3-root.io.87.5.0-root.io.66.20.1-root.io.16.21.3-root.io.96.20.1-root.io.25.29.0-root.io.45.28.5-root.io.15.28.5-root.io.26.20.1-root.io.36.21.3-root.io.106.21.3-root.io.116.19.2-root.io.86.21.2-root.io.76.19.2-root.io.96.19.2-root.io.105.29.0-root.io.55.28.5-root.io.35.29.0-root.io.65.28.5-root.io.47.5.0-root.io.77.5.0-root.io.86.20.1-root.io.46.21.3-root.io.12
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1525 is a medium vulnerability (CVSS 6.5) in Nodejs Undici, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in undici 6.24.0.

References

Show 151 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open