{"id":"CVE-2026-1525","aliases":["ALSA-2026:7080","ALSA-2026:7123","ALSA-2026:7350","ALSA-2026:7670","ALSA-2026:7675","BELL-CVE-2026-1525","CLSA-2026-1775435423","CLSA-2026-1779065182","CLSA-2026-1785204338","CLSA-2026-1788560495","CLSA-2026-1790542220","CLSA-2026-1791028079","CLSA-2026-1791973587","CLSA-2026-1792867313","DEBIAN-CVE-2026-1525","EUVD-2026-11685","GHSA-2mjp-6q6p-2qxm","RHSA-2026:7080","RHSA-2026:7123","RHSA-2026:7302","RHSA-2026:7310","RHSA-2026:7350","RHSA-2026:7670","RHSA-2026:7675","RHSA-2026:7983","RLSA-2026:7080","RLSA-2026:7123","RLSA-2026:7302","RLSA-2026:7350","RLSA-2026:7670","RLSA-2026:7675","ROOT-APP-NPM-CVE-2026-1525","UBUNTU-CVE-2026-1525"],"status":"published","title":"undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0056,"percentile":0.46942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-03-12T19:56:55Z","modified":"2026-10-30T12:17:06Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["6.24.0","7.24.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["20.20.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs","fixed_in":["22.22.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["24.16.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["20.20.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs","fixed_in":["22.22.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["24.16.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["5.28.5-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["7.24.5+dfsg+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["6.21.2-aikido.6","5.29.0-aikido.3","6.19.2-aikido.7","6.21.3-aikido.8","7.5.0-aikido.6","6.20.1-aikido.1","6.21.3-aikido.9","6.20.1-aikido.2","5.29.0-aikido.4","5.28.5-aikido.1","5.28.5-aikido.2","6.20.1-aikido.3","6.21.3-aikido.10","6.21.3-aikido.11","6.19.2-aikido.8","6.21.2-aikido.7","6.19.2-aikido.9","6.19.2-aikido.10","5.29.0-aikido.5","5.28.5-aikido.3","5.29.0-aikido.6","5.28.5-aikido.4","7.5.0-aikido.7","7.5.0-aikido.8","6.20.1-aikido.4","6.21.3-aikido.12"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["6.21.3-root.io.3","6.21.3-root.io.4","6.21.3-root.io.5","7.5.0-root.io.3","6.21.2-root.io.3","6.21.3-root.io.6","6.21.2-root.io.4","7.5.0-root.io.4","6.21.2-root.io.5","7.5.0-root.io.5","6.21.3-root.io.7","6.19.2-root.io.6","5.29.0-root.io.1","5.29.0-root.io.2","6.21.2-root.io.6","5.29.0-root.io.3","6.19.2-root.io.7","6.21.3-root.io.8","7.5.0-root.io.6","6.20.1-root.io.1","6.21.3-root.io.9","6.20.1-root.io.2","5.29.0-root.io.4","5.28.5-root.io.1","5.28.5-root.io.2","6.20.1-root.io.3","6.21.3-root.io.10","6.21.3-root.io.11","6.19.2-root.io.8","6.21.2-root.io.7","6.19.2-root.io.9","6.19.2-root.io.10","5.29.0-root.io.5","5.28.5-root.io.3","5.29.0-root.io.6","5.28.5-root.io.4","7.5.0-root.io.7","7.5.0-root.io.8","6.20.1-root.io.4","6.21.3-root.io.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.24.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.24.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+4006+3c416519"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.module_el8.10.0+4061+f8ceeab9"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"20.20.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"24.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"20.20.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"24.16.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.29.0-tuxcare.0"},{"fixed":"5.29.0-tuxcare.4"}]}],"versions":["5.29.0","5.29.0-tuxcare.1","5.29.0-tuxcare.2","5.29.0-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.28.5-tuxcare.0"},{"fixed":"5.28.5-tuxcare.4"}]}],"versions":["5.28.5","5.28.5-tuxcare.1","5.28.5-tuxcare.2","5.28.5-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.4"}]}],"versions":["6.11.1","6.11.1-tuxcare.1","6.11.1-tuxcare.2","6.11.1-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.1"}]}],"versions":["5.5.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.1"}]}],"versions":["6.19.7"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.2"}]}],"versions":["6.19.5","6.19.5-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.24.5+dfsg+~cs3.2.0-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.24.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.24.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+2084+ab509703"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.2-aikido.6"},{"fixed":"5.29.0-aikido.3"},{"fixed":"6.19.2-aikido.7"},{"fixed":"6.21.3-aikido.8"},{"fixed":"7.5.0-aikido.6"},{"fixed":"6.20.1-aikido.1"},{"fixed":"6.21.3-aikido.9"},{"fixed":"6.20.1-aikido.2"},{"fixed":"5.29.0-aikido.4"},{"fixed":"5.28.5-aikido.1"},{"fixed":"5.28.5-aikido.2"},{"fixed":"6.20.1-aikido.3"},{"fixed":"6.21.3-aikido.10"},{"fixed":"6.21.3-aikido.11"},{"fixed":"6.19.2-aikido.8"},{"fixed":"6.21.2-aikido.7"},{"fixed":"6.19.2-aikido.9"},{"fixed":"6.19.2-aikido.10"},{"fixed":"5.29.0-aikido.5"},{"fixed":"5.28.5-aikido.3"},{"fixed":"5.29.0-aikido.6"},{"fixed":"5.28.5-aikido.4"},{"fixed":"7.5.0-aikido.7"},{"fixed":"7.5.0-aikido.8"},{"fixed":"6.20.1-aikido.4"},{"fixed":"6.21.3-aikido.12"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.3-root.io.3"},{"fixed":"6.21.3-root.io.4"},{"fixed":"6.21.3-root.io.5"},{"fixed":"7.5.0-root.io.3"},{"fixed":"6.21.2-root.io.3"},{"fixed":"6.21.3-root.io.6"},{"fixed":"6.21.2-root.io.4"},{"fixed":"7.5.0-root.io.4"},{"fixed":"6.21.2-root.io.5"},{"fixed":"7.5.0-root.io.5"},{"fixed":"6.21.3-root.io.7"},{"fixed":"6.19.2-root.io.6"},{"fixed":"5.29.0-root.io.1"},{"fixed":"5.29.0-root.io.2"},{"fixed":"6.21.2-root.io.6"},{"fixed":"5.29.0-root.io.3"},{"fixed":"6.19.2-root.io.7"},{"fixed":"6.21.3-root.io.8"},{"fixed":"7.5.0-root.io.6"},{"fixed":"6.20.1-root.io.1"},{"fixed":"6.21.3-root.io.9"},{"fixed":"6.20.1-root.io.2"},{"fixed":"5.29.0-root.io.4"},{"fixed":"5.28.5-root.io.1"},{"fixed":"5.28.5-root.io.2"},{"fixed":"6.20.1-root.io.3"},{"fixed":"6.21.3-root.io.10"},{"fixed":"6.21.3-root.io.11"},{"fixed":"6.19.2-root.io.8"},{"fixed":"6.21.2-root.io.7"},{"fixed":"6.19.2-root.io.9"},{"fixed":"6.19.2-root.io.10"},{"fixed":"5.29.0-root.io.5"},{"fixed":"5.28.5-root.io.3"},{"fixed":"5.29.0-root.io.6"},{"fixed":"5.28.5-root.io.4"},{"fixed":"7.5.0-root.io.7"},{"fixed":"7.5.0-root.io.8"},{"fixed":"6.20.1-root.io.4"},{"fixed":"6.21.3-root.io.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","tags":["Mitigation","Vendor Advisory","advisory","web","article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6","tags":["Technical Description","web","article"]},{"url":"https://cwe.mitre.org/data/definitions/444.html","tags":["Technical Description","web","article"]},{"url":"https://hackerone.com/reports/3556037","tags":["Permissions Required","web","article"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2mjp-6q6p-2qxm"},{"url":"https://access.redhat.com/errata/RHSA-2026:7080","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1526","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21710","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27135","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27904","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453151","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7080.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7123","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7123.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7350","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1527","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21711","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21712","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21716","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2581","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453162","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7350.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7670","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7670.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7675","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7675.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-1525","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1525.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1525","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7080.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1525","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7692","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","tags":["article"]},{"url":"https://hackerone.com/reports/3481206","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj","tags":["article"]},{"url":"https://hackerone.com/reports/3537648","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","tags":["article"]},{"url":"https://hackerone.com/reports/3487486","tags":["article"]},{"url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25547","tags":["advisory"]},{"url":"https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","tags":["article"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-154019","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7302","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7302.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7310","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7310.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7350.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","tags":["article"]},{"url":"https://hackerone.com/reports/3487198","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h","tags":["article"]},{"url":"https://hackerone.com/reports/3513473","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21711","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21712","tags":["advisory"]},{"url":"https://hackerone.com/reports/3546390","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21713","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21715","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21716","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21717","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-151374","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7670.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7983","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7983.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7080","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7123","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7302","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7670","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7675","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1525","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-1525","title":"undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T19:56:55.092Z","modified":"2026-03-12T20:46:13.379Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-11685","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T19:56:55Z","modified":"2026-03-12T20:46:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:35.389351Z"}],"ghsa":[{"id":"GHSA-2mjp-6q6p-2qxm","title":"Undici has an HTTP Request/Response Smuggling issue","description":"### Impact\n\nUndici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed HTTP/1.1 requests with multiple conflicting `Content-Length` values on the wire.\n\n**Who is impacted:**\n  - Applications using `undici.request()`, `undici.Client`, or similar low-level APIs with headers passed as flat arrays\n  - Applications that accept user-controlled header names without case-normalization\n\n**Potential consequences:**\n  - **Denial of Service**: Strict HTTP parsers (proxies, servers) will reject requests with duplicate `Content-Length` headers (400 Bad Request)\n  - **HTTP Request Smuggling**: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking\n\n### Patches\n\n Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\n### Workarounds\n\n  If upgrading is not immediately possible:\n\n  1. **Validate header names**: Ensure no duplicate `Content-Length` headers (case-insensitive) are present before passing headers to undici\n  2. **Use object format**: Pass headers as a plain object (`{ 'content-length': '123' }`) rather than an array, which naturally deduplicates by key\n  3. **Sanitize user input**: If headers originate from user input, normalize header names to lowercase and reject duplicates","status":"published","published":"2026-03-13T20:07:03Z","modified":"2026-03-13T20:07:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-1525","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T20:16:02.67Z","modified":"2026-06-17T10:15:59.927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"BELL-CVE-2026-1525","status":"published","published":"2026-03-13T06:08:19.867679Z","modified":"2026-06-16T07:15:05.006618175Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-1525","title":"undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T19:56:55.092Z","modified":"2026-10-28T02:30:30.631764352Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-1525","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.  Who is impacted:    *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays   *  Applications that accept user-controlled header names without case-normalization   Potential consequences:    *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)   *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T20:16:02.67Z","modified":"2026-10-01T03:02:51.135630988Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"GHSA-2mjp-6q6p-2qxm","title":"Undici has an HTTP Request/Response Smuggling issue","description":"### Impact\n\nUndici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed HTTP/1.1 requests with multiple conflicting `Content-Length` values on the wire.\n\n**Who is impacted:**\n  - Applications using `undici.request()`, `undici.Client`, or similar low-level APIs with headers passed as flat arrays\n  - Applications that accept user-controlled header names without case-normalization\n\n**Potential consequences:**\n  - **Denial of Service**: Strict HTTP parsers (proxies, servers) will reject requests with duplicate `Content-Length` headers (400 Bad Request)\n  - **HTTP Request Smuggling**: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking\n\n### Patches\n\n Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\n### Workarounds\n\n  If upgrading is not immediately possible:\n\n  1. **Validate header names**: Ensure no duplicate `Content-Length` headers (case-insensitive) are present before passing headers to undici\n  2. **Use object format**: Pass headers as a plain object (`{ 'content-length': '123' }`) rather than an array, which naturally deduplicates by key\n  3. **Sanitize user input**: If headers originate from user input, normalize header names to lowercase and reject duplicates","status":"published","published":"2026-03-13T20:07:03Z","modified":"2026-09-10T03:50:36.493109202Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RHSA-2026:7080","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-04-09T10:11:50Z","modified":"2026-10-20T10:14:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7123","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-09T10:11:55Z","modified":"2026-10-20T10:14:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7302","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-10T10:09:10Z","modified":"2026-10-20T10:15:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7310","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-04-10T10:09:12Z","modified":"2026-10-20T10:15:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7350","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-10T10:09:15Z","modified":"2026-10-20T10:15:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7670","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-13T10:07:20Z","modified":"2026-10-20T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7675","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-04-13T10:07:23Z","modified":"2026-10-20T10:16:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7983","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-15T10:10:24Z","modified":"2026-10-20T10:16:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:7080","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-12T06:07:10.449425Z","modified":"2026-04-12T06:30:05.94473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7123","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T00:01:14.433042Z","modified":"2026-04-09T00:30:06.477776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7302","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T18:03:44.293189Z","modified":"2026-04-09T18:24:58.970412Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-10T00:04:09.070331Z","modified":"2026-04-10T00:30:06.392552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7670","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-13T06:01:13.567166Z","modified":"2026-04-13T06:30:06.733151Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:34.977687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-APP-NPM-CVE-2026-1525","title":"CVE-2026-1525 in undici - Patched by Root","description":"Root has patched CVE-2026-1525 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T11:15:55Z","modified":"2026-10-30T12:17:06.980695108Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2026-1525","description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted:   *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays   *  Applications that accept user-controlled header names without case-normalization Potential consequences:   *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)   *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","status":"published","published":"2026-03-12T20:16:00Z","modified":"2026-10-17T12:59:53.062616377Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:7080","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-10-29T11:30:40.550096651Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7123","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-10-29T11:02:29.556841529Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-10-29T11:32:37.577752858Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7670","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:02:29.661659123Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:30:49.714638043Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1775435423","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.29.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:49.516536742Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779065182","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.4.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:27.695670162Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1785204338","title":"TuxCare security update for undici (6 CVEs)","description":"TuxCare rebuilt undici to address 6 CVEs. Fixed in 6.11.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.324760253Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788560495","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.","status":"published","published":"2026-09-04T22:21:35Z","modified":"2026-10-15T09:48:03.135244229Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790542220","title":"TuxCare security update for undici (12 CVEs)","description":"TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.","status":"published","published":"2026-09-27T20:50:20Z","modified":"2026-10-15T09:45:09.792474642Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791028079","title":"TuxCare security update for undici (11 CVEs)","description":"TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.","status":"published","published":"2026-10-03T11:47:59Z","modified":"2026-10-15T09:47:57.895518604Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791973587","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-14T10:26:27Z","modified":"2026-10-24T19:15:03.446818583Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792867313","title":"TuxCare security update for undici-types (15 CVEs)","description":"TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-24T18:41:49Z","modified":"2026-10-25T01:30:04.32437095Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}