Every CVE Search/ Get API key

CVE-2026-11525

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

3.7 LowFix available

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.24%Unchanged since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
CVE-2026-11525
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-183
Updated
2026-11-02
EUVDEUVD-2026-37758 3.7

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
EUVD-2026-37758
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g8m3-5g58-fq7m 3.7

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Impact

When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:

  • SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.
  • SameSite=StrictLax is parsed as Lax, a downgrade from Strict.

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
GHSA-g8m3-5g58-fq7m
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-183
Updated
2026-11-02
NVD 3.7

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
CVE-2026-11525
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-183
Updated
2026-11-02
OSV 3.7

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
CVE-2026-11525
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-183
Updated
2026-11-02
OSVDEBIAN-CVE-2026-11525 3.7

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
DEBIAN-CVE-2026-11525
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 45 moreShow less
OSVGHSA-g8m3-5g58-fq7m 3.7

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Impact

When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:

  • SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.
  • SameSite=StrictLax is parsed as Lax, a downgrade from Strict.

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
GHSA-g8m3-5g58-fq7m
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-183
Updated
2026-11-02
OSVRHSA-2026:35841 8.1

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35842 8.1

Red Hat Security Advisory: nodejs22 security, bug fix, and enhancement update

Record
RHSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35891 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35892 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:39868 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:41947 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:45783 3.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:45783
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:35841 8.1

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35842 8.1

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35891 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35892 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:39868 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:41947 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-11525 3.7

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
UBUNTU-CVE-2026-11525
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:35841 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35841
Updated
2026-11-02
OSVALSA-2026:35842 No score

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35842
Updated
2026-11-02
OSVALSA-2026:35891 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35891
Updated
2026-11-02
OSVALSA-2026:35892 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35892
Updated
2026-11-02
OSVALSA-2026:39868 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:39868
Updated
2026-11-02
OSVALSA-2026:41947 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-8] (JIRA:AlmaLinux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41947
Updated
2026-11-02
OSVAZL-91194 No score

CVE-2026-11525 affecting package nodejs for versions less than 24.18.1-1

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Record
AZL-91194
Updated
2026-11-02
OSVCLSA-2026-1784336934 No score

TuxCare security update for undici (3 CVEs)

TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.28.5-tuxcare.5.

Record
CLSA-2026-1784336934
Updated
2026-11-02
OSVCLSA-2026-1785204338 No score

TuxCare security update for undici (6 CVEs)

TuxCare rebuilt undici to address 6 CVEs. Fixed in 6.11.1-tuxcare.4.

Record
CLSA-2026-1785204338
Updated
2026-11-02
OSVCLSA-2026-1786370674 No score

TuxCare security update for undici (2 CVEs)

TuxCare rebuilt undici to address 2 CVEs. Fixed in 5.29.0-tuxcare.5.

Record
CLSA-2026-1786370674
Updated
2026-11-02
OSVCLSA-2026-1790542220 No score

TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.

Record
CLSA-2026-1790542220
Updated
2026-11-02
OSVCLSA-2026-1791028079 No score

TuxCare security update for undici (11 CVEs)

TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.

Record
CLSA-2026-1791028079
Updated
2026-11-02
OSVCLSA-2026-1791973587 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1791973587
Updated
2026-11-02
OSVCLSA-2026-1792451423 No score

TuxCare security update for undici (5 CVEs)

TuxCare rebuilt undici to address 5 CVEs. Fixed in 7.24.4-tuxcare.1.

Record
CLSA-2026-1792451423
Updated
2026-11-02
OSVCLSA-2026-1792867313 No score

TuxCare security update for undici-types (15 CVEs)

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1792867313
Updated
2026-11-02
OSVopenSUSE-SU-2026:11121-1 No score

corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11121-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21058-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
openSUSE-SU-2026:21058-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21236-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
openSUSE-SU-2026:21236-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-11525 No score

CVE-2026-11525 in undici - Patched by Root

Root has patched CVE-2026-11525 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-11525
Updated
2026-11-05
OSVSUSE-SU-2026:22368-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:22368-1
Updated
2026-11-02
OSVSUSE-SU-2026:22565-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
SUSE-SU-2026:22565-1
Updated
2026-11-02
OSVSUSE-SU-2026:2633-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to 24.17.0:

  • CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2633-1
Updated
2026-11-02
OSVSUSE-SU-2026:2647-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2647-1
Updated
2026-11-02
OSVSUSE-SU-2026:2695-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

  • CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
  • CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
  • CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
  • CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
  • CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
  • CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
  • CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
  • CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
  • CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
  • CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
  • CVE-2026-48937: http2: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).
  • CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).
  • CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec ( bsc#1266318).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
Record
SUSE-SU-2026:2695-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02
OSVSUSE-SU-2026:4248-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4248-1
Updated
2026-11-02
OSVSUSE-SU-2026:4261-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4261-1
Updated
2026-11-02
OSVSUSE-SU-2026:4355-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:4355-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 6.27.0
6.27.0
undici
npm
 7.0.0 up to 7.28.0
7.28.0
undici
npm
 8.0.0 up to 8.5.0
8.5.0
nodejs24
AlmaLinux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
AlmaLinux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
AlmaLinux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
AlmaLinux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
AlmaLinux:10
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
AlmaLinux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
Show 206 moreShow less
Affected packages
PackageAffectedFixed
nodejs-devel
AlmaLinux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-docs
AlmaLinux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-full-i18n
AlmaLinux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
AlmaLinux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
AlmaLinux:10
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs
AlmaLinux:9
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-devel
AlmaLinux:9
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-docs
AlmaLinux:9
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-full-i18n
AlmaLinux:9
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-libs
AlmaLinux:9
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-nodemon
AlmaLinux:9
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
 before 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
v8-13.6-devel
AlmaLinux:9
 before 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
nodejs
AlmaLinux:9
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-devel
AlmaLinux:9
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-docs
AlmaLinux:9
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-full-i18n
AlmaLinux:9
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-libs
AlmaLinux:9
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-nodemon
AlmaLinux:9
 before 3.0.1-1.module_el9.7.0+208+fb06c0ab
3.0.1-1.module_el9.7.0+208+fb06c0ab
nodejs-packaging
AlmaLinux:9
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
 before 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
v8-12.4-devel
AlmaLinux:9
 before 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
nodejs
AlmaLinux:8
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-devel
AlmaLinux:8
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-docs
AlmaLinux:8
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-full-i18n
AlmaLinux:8
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-libs
AlmaLinux:8
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-nodemon
AlmaLinux:8
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
 before 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
v8-13.6-devel
AlmaLinux:8
 before 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
nodejs
AlmaLinux:8
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-devel
AlmaLinux:8
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-docs
AlmaLinux:8
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-full-i18n
AlmaLinux:8
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-libs
AlmaLinux:8
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-nodemon
AlmaLinux:8
 before 3.0.1-1.module_el8.10.0+3956+47c9ee9f
3.0.1-1.module_el8.10.0+3956+47c9ee9f
nodejs-packaging
AlmaLinux:8
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
 before 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
v8-12.4-devel
AlmaLinux:8
 before 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
nodejs
Azure Linux:3
 before 24.18.1-1
24.18.1-1
undici
TuxCare:npm
 5.28.5-tuxcare.0 up to 5.28.5-tuxcare.5, plus listed versions
5.28.55.28.5-tuxcare.15.28.5-tuxcare.25.28.5-tuxcare.35.28.5-tuxcare.4
5.28.5-tuxcare.5
undici
TuxCare:npm
 6.11.1-tuxcare.0 up to 6.11.1-tuxcare.4, plus listed versions
6.11.16.11.1-tuxcare.16.11.1-tuxcare.26.11.1-tuxcare.3
6.11.1-tuxcare.4
undici
TuxCare:npm
 5.29.0-tuxcare.0 up to 5.29.0-tuxcare.5, plus listed versions
5.29.05.29.0-tuxcare.15.29.0-tuxcare.25.29.0-tuxcare.35.29.0-tuxcare.4
5.29.0-tuxcare.5
undici
TuxCare:npm
 6.19.7-tuxcare.0 up to 6.19.7-tuxcare.1, plus listed versions
6.19.7
6.19.7-tuxcare.1
undici
TuxCare:npm
 6.19.5-tuxcare.0 up to 6.19.5-tuxcare.2, plus listed versions
6.19.56.19.5-tuxcare.1
6.19.5-tuxcare.2
undici
TuxCare:npm
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici
TuxCare:npm
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.1, plus listed versions
7.24.4
7.24.4-tuxcare.1
undici-types
TuxCare:npm
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 35 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.5.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 6 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
8.5.0+dfsg+~cs3.2.0-1
nodejs24
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.3-3.module+el9.8.0+24355+35d95b59
0:3.0.3-3.module+el9.8.0+24355+35d95b59
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
 before 1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
 before 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.1-1.module+el9.8.0+24156+bb41d456
0:3.0.1-1.module+el9.8.0+24156+bb41d456
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
 before 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
 before 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
nodejs24
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-bin
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-devel
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-docs
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-libs
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
nodejs24-npm
Red Hat:hummingbird:1
 before 0:11.16.0-1.24.18.0.0.3.hum1
0:11.16.0-1.24.18.0.0.3.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
 before 0:24.18.0-0.3.hum1
0:24.18.0-0.3.hum1
v8-13.6-devel
Red Hat:hummingbird:1
 before 0:13.6.233.17-1.24.18.0.0.3.hum1
0:13.6.233.17-1.24.18.0.0.3.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
 before 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
 before 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.1-1.module+el8.10.0+24500+8eb51621
0:3.0.1-1.module+el8.10.0+24500+8eb51621
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
npm
Red Hat:enterprise_linux:8::appstream
 before 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
 before 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
nodejs26
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-bin
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-devel
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-docs
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-libs
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs26-npm
Red Hat:hummingbird:1
 before 0:11.17.0-1.26.5.0.1.5.hum1
0:11.17.0-1.26.5.0.1.5.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
 before 0:26.5.0-1.5.hum1
0:26.5.0-1.5.hum1
nodejs24
Rocky Linux:10
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs22
Rocky Linux:10
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40165+d075e3f2
0:3.0.1-1.module+el9.7.0+40165+d075e3f2
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40153+4d595597
0:3.0.1-1.module+el9.7.0+40153+4d595597
nodejs
Rocky Linux:8
 before 1:24.18.0-1.module+el8.10.0+40252+a58646bc
1:24.18.0-1.module+el8.10.0+40252+a58646bc
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
undici
Root:npm
 before 7.28.0-aikido.1
7.28.0-aikido.18.5.0-aikido.17.28.0-aikido.26.27.0-aikido.17.28.0-aikido.37.28.0-aikido.46.27.0-aikido.27.28.0-aikido.56.27.0-aikido.36.27.0-aikido.46.27.0-aikido.56.27.0-aikido.6
@rootio/undici
Root:npm
 before 7.28.0-root.io.1
7.28.0-root.io.18.5.0-root.io.17.28.0-root.io.26.27.0-root.io.17.28.0-root.io.37.28.0-root.io.46.27.0-root.io.27.28.0-root.io.56.27.0-root.io.36.27.0-root.io.46.27.0-root.io.56.27.0-root.io.6
nodejs22
SUSE:Linux Enterprise Server 16.0
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 22.23.0-150700.3.12.1
22.23.0-150700.3.12.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs18
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known
nodejs24
openSUSE:Tumbleweed
 before 24.17.0-1.1
24.17.0-1.1
nodejs22
openSUSE:Leap 16.0
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
openSUSE:Leap 16.0
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11525 is a low vulnerability (CVSS 3.7) in Nodejs Undici, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in undici 6.27.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 84 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open