{"id":"CVE-2025-22150","aliases":["ALPINE-CVE-2025-22150","ALSA-2025:1351","ALSA-2025:1443","ALSA-2025:1446","ALSA-2025:1582","ALSA-2025:1611","ALSA-2025:1613","AZL-55931","AZL-55950","BELL-CVE-2025-22150","CLSA-2025-1758102713","CLSA-2026-1772583202","CLSA-2026-1772617597","CLSA-2026-1788560495","CLSA-2026-1790542220","CLSA-2026-1791028079","CLSA-2026-1791973587","CLSA-2026-1792867313","DEBIAN-CVE-2025-22150","EUVD-2025-0154","GHSA-c76h-2ccp-4975","RHSA-2025:1351","RHSA-2025:1443","RHSA-2025:1446","RHSA-2025:1582","RHSA-2025:1611","RHSA-2025:1613","RLSA-2025:1351","RLSA-2025:1446","RLSA-2025:1582","RLSA-2025:1611","RLSA-2025:1613","ROOT-APP-NPM-CVE-2025-22150","ROOT-OS-DEBIAN-12-CVE-2025-22150","SUSE-SU-2025:0232-1","SUSE-SU-2025:0233-1","SUSE-SU-2025:0234-1","SUSE-SU-2025:0237-1","SUSE-SU-2025:0284-1","SUSE-SU-2026:3929-1","SUSE-SU-2026:3930-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1","UBUNTU-CVE-2025-22150","openSUSE-SU-2025:14706-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"Undici Uses Insufficiently Random Values","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00763,"percentile":0.55816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2025-01-21T17:46:58Z","modified":"2026-10-30T12:17:11Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["5.28.5","6.21.1","7.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.3-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["18.20.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["18.20.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["22.13.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-undici","fixed_in":["7.3.0+dfsg1+~cs24.12.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["7.3.0+dfsg1+~cs24.12.11-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["6.19.2-aikido.7","6.20.1-aikido.3","6.19.2-aikido.8","6.19.2-aikido.9","6.19.2-aikido.10","6.20.1-aikido.4","5.28.5-aikido.1","5.28.5-aikido.2","6.21.1-aikido.1","6.21.1-aikido.2","6.21.1-aikido.3","5.28.5-aikido.3","5.28.5-aikido.4","6.21.1-aikido.4","6.21.1-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["6.19.2-root.io.1","6.19.2-root.io.2","6.19.2-root.io.3","6.19.2-root.io.4","6.19.2-root.io.5","6.19.2-root.io.6","6.19.2-root.io.7","6.20.1-root.io.3","6.19.2-root.io.8","6.19.2-root.io.9","6.19.2-root.io.10","6.20.1-root.io.4","5.28.5-root.io.1","5.28.5-root.io.2","6.21.1-root.io.1","6.21.1-root.io.2","6.21.1-root.io.3","5.28.5-root.io.3","5.28.5-root.io.4","6.21.1-root.io.4","6.21.1-root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-node-undici","fixed_in":["5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"5.28.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.21.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.18.2.1.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el9.5.0+137+381f3eaf"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el9.5.0+137+381f3eaf"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el9.5.0+137+381f3eaf"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module_el9.5.0+137+381f3eaf"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.2.0+36+853e48f5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+124+df88fe49"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.18.2.1.module_el9.5.0+137+381f3eaf"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+124+df88fe49"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.18.20.6.1.module_el9.5.0+136+92f38f3c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el8.10.0+3960+fcfbf683"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el8.10.0+3960+fcfbf683"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el8.10.0+3960+fcfbf683"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module_el8.10.0+3960+fcfbf683"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.18.20.6.1.module_el8.10.0+3960+fcfbf683"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.13.1.1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+136+92f38f3c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+136+92f38f3c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.13.1.1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.13.1.1.module_el9.5.0+139+09296491"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.3-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"18.20.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"18.20.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"22.13.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.1"}]}],"versions":["6.11.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.1"}]}],"versions":["6.19.7"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.2"}]}],"versions":["6.19.5","6.19.5-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.0+dfsg1+~cs24.12.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.0+dfsg1+~cs24.12.11-1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"4.5.0"},{"fixed":"5.28.5"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.21.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.18.2.1.module+el8.10.0+22767+a3309b10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.18.2.1.module+el9.5.0+22758+4ad2c198"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.18.20.6.1.module+el9.5.0+22773+9a359385"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+21159+f5a7145d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19439+7b18b275"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19439+7b18b275"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.18.20.6.1.module+el8.10.0+22776+24cd6c55"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.13.1.1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.13.1.1.module+el8.10.0+22759+46b58560"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.13.1.1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.13.1.1.module+el9.5.0+22763+17233acb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-1.module+el8.10.0+1932+2f13f218"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.6-1.module+el8.10.0+1934+a521c41f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.13.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.2-aikido.7"},{"fixed":"6.20.1-aikido.3"},{"fixed":"6.19.2-aikido.8"},{"fixed":"6.19.2-aikido.9"},{"fixed":"6.19.2-aikido.10"},{"fixed":"6.20.1-aikido.4"},{"fixed":"5.28.5-aikido.1"},{"fixed":"5.28.5-aikido.2"},{"fixed":"6.21.1-aikido.1"},{"fixed":"6.21.1-aikido.2"},{"fixed":"6.21.1-aikido.3"},{"fixed":"5.28.5-aikido.3"},{"fixed":"5.28.5-aikido.4"},{"fixed":"6.21.1-aikido.4"},{"fixed":"6.21.1-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.2-root.io.1"},{"fixed":"6.19.2-root.io.2"},{"fixed":"6.19.2-root.io.3"},{"fixed":"6.19.2-root.io.4"},{"fixed":"6.19.2-root.io.5"},{"fixed":"6.19.2-root.io.6"},{"fixed":"6.19.2-root.io.7"},{"fixed":"6.20.1-root.io.3"},{"fixed":"6.19.2-root.io.8"},{"fixed":"6.19.2-root.io.9"},{"fixed":"6.19.2-root.io.10"},{"fixed":"6.20.1-root.io.4"},{"fixed":"5.28.5-root.io.1"},{"fixed":"5.28.5-root.io.2"},{"fixed":"6.21.1-root.io.1"},{"fixed":"6.21.1-root.io.2"},{"fixed":"6.21.1-root.io.3"},{"fixed":"5.28.5-root.io.3"},{"fixed":"5.28.5-root.io.4"},{"fixed":"6.21.1-root.io.4"},{"fixed":"6.21.1-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.2"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.4"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.root.io.5"},{"fixed":"5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150500.11.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150500.11.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150500.11.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150500.11.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-150400.9.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-8.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.6-8.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150600.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-150600.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-150600.13.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.1-150600.13.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.21.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.21.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.13.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://hackerone.com/reports/2913312","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f","tags":["x_refsource_MISC","article","web","report"]},{"url":"https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22150","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c76h-2ccp-4975"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-22150","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1351","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22150","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23083","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23085","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339176","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339392","tags":["report"]},{"url":"https://bugzilla.redhat.com/2342618","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-1351.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1443","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-1443.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1446","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-1446.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1582","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-1582.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1611","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-1611.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1613","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-1613.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-22150","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1758102713.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1772617597.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22150.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-22150","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2342618","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1351.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22150","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23083","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/january-2025-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23085","tags":["advisory"]},{"url":"https://nodejs.org/pt/blog/vulnerability/january-2025-security-releases","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1443.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1446.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1582.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1611.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1613.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1351","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1446","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1582","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1611","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1613","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250232-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236250","tags":["report"]},{"url":"https://bugzilla.suse.com/1236251","tags":["report"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250233-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250234-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250237-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250284-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1268097","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268554","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268598","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://bugzilla.suse.com/1272882","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272949","tags":["report"]},{"url":"https://bugzilla.suse.com/1272950","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://bugzilla.suse.com/1277587","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263930-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1256570","tags":["report"]},{"url":"https://bugzilla.suse.com/1256573","tags":["report"]},{"url":"https://bugzilla.suse.com/1256574","tags":["report"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://bugzilla.suse.com/1272958","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264261-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-22150","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WLMBUS6KTOM5ZRBZUFNAWPANSHPLYG3W/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-22150","title":"Undici Uses Insufficiently Random Values","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T17:46:58.872Z","modified":"2025-02-12T20:41:22.041Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-0154","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T17:46:58Z","modified":"2025-02-12T20:41:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:56.514594Z"}],"ghsa":[{"id":"GHSA-c76h-2ccp-4975","title":"Use of Insufficiently Random Values in undici","description":"### Impact\n\n[Undici `fetch()` uses Math.random()](https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113) to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.\n\nIf there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.\n\n### Patches\n\nThis is fixed in 5.28.5; 6.21.1; 7.2.3.\n\n### Workarounds\n\nDo not issue multipart requests to attacker controlled servers.\n\n### References\n\n* https://hackerone.com/reports/2913312\n* https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f\n","status":"published","published":"2025-01-21T21:10:47Z","modified":"2025-01-22T08:01:28Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:38:27.974809Z"}],"nvd":[{"id":"CVE-2025-22150","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:14.887Z","modified":"2026-06-17T08:45:21.6Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:10:49.483601Z"}],"osv":[{"id":"ALPINE-CVE-2025-22150","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:14.887Z","modified":"2026-08-27T22:18:02.79109993Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-22150","status":"published","published":"2025-01-23T05:58:56.51186Z","modified":"2026-02-18T07:38:17.654544Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"CVE-2025-22150","title":"Undici Uses Insufficiently Random Values","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T17:46:58.872Z","modified":"2026-10-28T02:30:31.002843786Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-22150","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:14.887Z","modified":"2026-09-01T20:05:44.179670948Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"GHSA-c76h-2ccp-4975","title":"Use of Insufficiently Random Values in undici","description":"### Impact\n\n[Undici `fetch()` uses Math.random()](https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113) to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.\n\nIf there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.\n\n### Patches\n\nThis is fixed in 5.28.5; 6.21.1; 7.2.3.\n\n### Workarounds\n\nDo not issue multipart requests to attacker controlled servers.\n\n### References\n\n* https://hackerone.com/reports/2913312\n* https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f\n","status":"published","published":"2025-01-21T21:10:47Z","modified":"2026-09-10T03:50:56.329194144Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"RHSA-2025:1351","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-02-13T10:05:00Z","modified":"2026-10-16T10:06:44Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:1443","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-02-14T10:03:23Z","modified":"2026-10-16T10:06:58Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:1446","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2025-02-14T10:03:24Z","modified":"2026-10-16T10:06:59Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:1582","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2025-02-18T10:02:43Z","modified":"2026-10-16T10:07:06Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:1611","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-02-18T10:02:44Z","modified":"2026-10-16T10:07:09Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:1613","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-02-18T10:02:45Z","modified":"2026-10-16T10:07:09Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RLSA-2025:1446","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:35:44.459056Z","modified":"2025-10-09T06:19:03.403942Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:1613","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-26T19:11:14.796455Z","modified":"2025-10-09T06:19:03.850418Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"ROOT-APP-NPM-CVE-2025-22150","title":"CVE-2025-22150 in undici - Patched by Root","description":"Root has patched CVE-2025-22150 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T11:32:57Z","modified":"2026-10-30T12:17:11.448208244Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-22150","title":"CVE-2025-22150 in node-undici - Patched by Root","description":"Root has patched CVE-2025-22150 in the node-undici package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:14:35Z","modified":"2026-08-26T01:12:43.241968191Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"UBUNTU-CVE-2025-22150","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:00Z","modified":"2026-10-17T12:56:46.685955731Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:1351","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-12T00:00:00Z","modified":"2026-10-29T11:02:22.34491145Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1443","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-13T00:00:00Z","modified":"2026-10-29T11:32:27.699487246Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1446","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-13T00:00:00Z","modified":"2026-10-29T11:32:27.528536129Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1582","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-17T00:00:00Z","modified":"2026-10-29T11:02:22.495339859Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1611","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-17T00:00:00Z","modified":"2026-10-29T11:02:22.429867278Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1613","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n  * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n  * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-17T00:00:00Z","modified":"2026-10-29T11:32:28.201193316Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-55931","title":"CVE-2025-22150 affecting package nodejs18 for versions less than 18.20.3-3","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:14Z","modified":"2026-04-21T04:36:01.944043Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55950","title":"CVE-2025-22150 affecting package nodejs for versions less than 20.14.0-5","description":"Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.","status":"published","published":"2025-01-21T18:15:14Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"CLSA-2025-1758102713","title":"nodejs: Fix of CVE-2025-22150","description":"- CVE-2025-22150: fix issue where undici used Math.random() to choose boundary\n  for multipart/form-data request, now uses secure random number generator","status":"published","published":"2025-09-17T09:51:56Z","modified":"2026-06-01T00:31:01.761211835Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1772583202","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 6.11.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:26.478895396Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772617597","title":"nodejs: Fix of 2 CVEs","description":"- CVE-2025-22150: fix issue where undici used Math.random() to choose boundary\n  for multipart/form-data request, now uses secure random number generator\n- CVE-2023-39333: fix maliciously crafted export names injection of JavaScript\n  code\n- Run full Node.js tests in %check\n- Fix comment typo in spec","status":"published","published":"2026-03-04T09:46:41Z","modified":"2026-10-21T10:45:46.560208412Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790542220","title":"TuxCare security update for undici (12 CVEs)","description":"TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.","status":"published","published":"2026-09-27T20:50:20Z","modified":"2026-10-15T09:45:09.792474642Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791028079","title":"TuxCare security update for undici (11 CVEs)","description":"TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.","status":"published","published":"2026-10-03T11:47:59Z","modified":"2026-10-15T09:47:57.895518604Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791973587","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-14T10:26:27Z","modified":"2026-10-24T19:15:03.446818583Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792867313","title":"TuxCare security update for undici-types (15 CVEs)","description":"TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-24T18:41:49Z","modified":"2026-10-25T01:30:04.32437095Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2025:14706-1","title":"corepack22-22.13.0-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.13.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-28T00:00:00Z","modified":"2026-02-04T03:05:55.177628Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"RLSA-2025:1351","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:34:26.141542Z","modified":"2026-02-05T08:45:18.395931Z","updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:1582","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-26T19:09:52.852483Z","modified":"2026-02-04T23:45:04.87123Z","updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:1611","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-26T19:09:52.852483Z","modified":"2026-02-04T09:15:04.531667Z","updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"SUSE-SU-2025:0232-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.18.2:\n\n- CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n","status":"published","published":"2025-01-24T14:33:49Z","modified":"2026-02-04T02:44:08.211304Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0233-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.6:\n\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n","status":"published","published":"2025-01-24T16:05:12Z","modified":"2026-02-04T02:52:56.364195Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0234-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.6:\n\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n","status":"published","published":"2025-01-24T16:34:19Z","modified":"2026-02-04T03:58:22.739723Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0237-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.18.2:\n\n- CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n","status":"published","published":"2025-01-24T19:33:36Z","modified":"2026-02-04T04:40:17.718276Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0284-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\nUpdate to 22.13.1:\n\n- CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n","status":"published","published":"2025-01-29T13:47:55Z","modified":"2026-02-04T03:34:32.068732Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:3929-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when defining the boundary for a `multipart`/`form-data`\n  request (bsc#1236258).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: `setCookie` function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via `Content-Encoding` may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many `A` records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n- CVE-2026-69192: ip-address: `Address4` decodes leading-zero octets as decimal while resolvers decode them as octal,\n  which allows for SSRF and trust-boundary bypass (bsc#1277587).\n","status":"published","published":"2026-09-03T07:18:06Z","modified":"2026-09-10T18:23:21.565514799Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3930-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when defining the boundary for a `multipart`/`form-data`\n  request (bsc#1236258).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: `setCookie` function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via `Content-Encoding` may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many `A` records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n- CVE-2026-69192: ip-address: `Address4` decodes leading-zero octets as decimal while resolvers decode them as octal,\n  which allows for SSRF and trust-boundary bypass (bsc#1277587).\n","status":"published","published":"2026-09-03T07:19:02Z","modified":"2026-09-10T18:23:17.854773396Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4248-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-17T15:59:50Z","modified":"2026-09-18T10:00:04.762818452Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4261-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-18T07:44:28Z","modified":"2026-09-18T18:00:04.233169266Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}