{"id":"CVE-2026-19534","aliases":["ALSA-2026:73428","ALSA-2026:73838","ALSA-2026:74085","ALSA-2026:75864","ALSA-2026:75870","ALSA-2026:76750","CLSA-2026-1790719646","CLSA-2026-1790756064","CLSA-2026-1790854776","CLSA-2026-1790856988","CLSA-2026-1790863423","CLSA-2026-1790895136","CLSA-2026-1791668718","CLSA-2026-1792478858","CLSA-2026-1792867308","CLSA-2026-1792867311","CLSA-2026-1794310630","DEBIAN-CVE-2026-19534","EUVD-2026-71636","GHSA-rfgv-xxqx-mfg5","RHSA-2026:66008","RHSA-2026:66605","RHSA-2026:71017","RHSA-2026:73428","RHSA-2026:73838","RHSA-2026:74085","RHSA-2026:75864","RHSA-2026:75870","RHSA-2026:76750","RHSA-2026:84589","RHSA-2026:84703","RLSA-2026:73428","RLSA-2026:73838","RLSA-2026:74085","RLSA-2026:75864","RLSA-2026:75870","RLSA-2026:76750","RLSA-2026:96226","RLSA-2026:97855","UBUNTU-CVE-2026-19534"],"status":"published","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00394,"percentile":0.3403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-252"],"published":"2026-09-04T17:10:05Z","modified":"2026-11-11T12:45:02Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["6.28.1","7.29.1","8.10.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["6.28.0-tuxcare.1","6.20.0-tuxcare.1","6.19.5-tuxcare.1","6.11.1-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"undici-types","fixed_in":["6.20.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.10.2+dfsg+~cs3.2.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.28.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.29.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.0-1.24.21.0.1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4252+aedd4c30"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el9.8.0+302+959ebcd4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.29.0-tuxcare.0"},{"fixed":"7.29.0-tuxcare.2"}]}],"versions":["7.29.0","7.29.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.3"}]}],"versions":["7.28.0","7.28.0-tuxcare.1","7.28.0-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.28.0-tuxcare.0"},{"fixed":"6.28.0-tuxcare.1"}]}],"versions":["6.28.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.1"}]}],"versions":["6.20.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.2"}]}],"versions":["6.19.7","6.19.7-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.1"}]}],"versions":["6.19.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.5"}]}],"versions":["6.11.1","6.11.1-tuxcare.1","6.11.1-tuxcare.2","6.11.1-tuxcare.3","6.11.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.2"}]}],"versions":["7.24.4","7.24.4-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.29.0-tuxcare.0"},{"fixed":"7.29.0-tuxcare.2"}]}],"versions":["7.29.0","7.29.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.1"}]}],"versions":["6.20.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.8-tuxcare.0"},{"fixed":"7.24.8-tuxcare.1"}]}],"versions":["7.24.8"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.2+dfsg+~cs3.2.2-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"6.7.0"},{"fixed":"6.28.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.2.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.1-1.26.8.2.0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.0-1.24.21.0.1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+24711+b610b202"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24711+b610b202"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24711+b610b202"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+24710+c2e9b41f"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24710+c2e9b41f"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24710+c2e9b41f"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+24709+804d6b5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24709+804d6b5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24709+804d6b5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.6.0+24789+4011c12f"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.21.0-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-3.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-2.module+el9.8.0+40374+17512296"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40280+057606e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el9.8.0+40263+faa47049"}]}],"bundled":26},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":26},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":26},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":26},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v6.28.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.10.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5"},{"url":"https://access.redhat.com/errata/RHSA-2026:73428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84961","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85152","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528735","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528759","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-73428.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73838","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2528717","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-73838.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74085","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-74085.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9496","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481394","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-75864.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75870","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-75870.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76750","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-76750.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19534.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19534","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66008","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84947","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85008","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85014","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28378","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19197","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66008.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14199","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-14199/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19197","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-19197","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19534","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28378","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28378","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84961","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85024","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66605.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71017","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71017.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528717","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-249187","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73428.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85152","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-249189","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73838.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-249188","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74085.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481394","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75864.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9496","tags":["advisory"]},{"url":"https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","tags":["article"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","tags":["article"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75870.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76750.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84589","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84589.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84703","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84703.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:73428","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:73838","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:74085","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:75864","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:75870","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76750","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96226","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563978","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96226","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:97855","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511089","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:97855","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19534","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-19534","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:10:05.081Z","modified":"2026-09-04T18:18:31.205Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248","CWE-252"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-71636","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:10:05Z","modified":"2026-09-04T18:18:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:11.774269Z"}],"ghsa":[{"id":"GHSA-rfgv-xxqx-mfg5","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","description":"### Impact\n\nThe undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never requested. The throw occurs in a `queueMicrotask` callback with no surrounding `try`/`catch`, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext `ws://` connection subject to a machine-in-the-middle. It affects the default `new WebSocket(url)` usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.\n\nAll releases starting at undici 6.7.0 are affected.\n\n### Patches\n\nUpgrade to undici 6.28.1, 7.29.1, or 8.10.2.\n\n### Workarounds\n\nNo workaround is available. The fix must be applied through an upgrade.","status":"published","published":"2026-09-29T18:21:33Z","modified":"2026-09-29T18:21:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-252"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:51.647Z","modified":"2026-09-16T20:41:08.75Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248","CWE-252"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-19534","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:10:05.081Z","modified":"2026-10-28T02:31:09.23512789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-252"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:51.647Z","modified":"2026-10-01T03:02:56.683520858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-rfgv-xxqx-mfg5","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","description":"### Impact\n\nThe undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never requested. The throw occurs in a `queueMicrotask` callback with no surrounding `try`/`catch`, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext `ws://` connection subject to a machine-in-the-middle. It affects the default `new WebSocket(url)` usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.\n\nAll releases starting at undici 6.7.0 are affected.\n\n### Patches\n\nUpgrade to undici 6.28.1, 7.29.1, or 8.10.2.\n\n### Workarounds\n\nNo workaround is available. The fix must be applied through an upgrade.","status":"published","published":"2026-09-29T18:21:33Z","modified":"2026-09-29T18:30:41.167602268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-252"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RHSA-2026:66008","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-10T10:17:09Z","modified":"2026-10-20T10:43:33.340874063Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-12T10:10:21Z","modified":"2026-10-20T10:13:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71017","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-30T10:16:55Z","modified":"2026-10-20T10:14:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73428","title":"Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update","status":"published","published":"2026-09-30T10:17:59Z","modified":"2026-10-20T10:15:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73838","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","status":"published","published":"2026-10-01T10:21:04Z","modified":"2026-10-20T10:15:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74085","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","status":"published","published":"2026-10-01T10:21:17Z","modified":"2026-10-20T10:15:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:75864","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-10-06T10:19:06Z","modified":"2026-10-20T10:15:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:75870","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-10-06T10:19:06Z","modified":"2026-10-20T10:15:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76750","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-10-08T10:20:05Z","modified":"2026-10-20T10:16:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:84589","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-10-20T10:17:38Z","modified":"2026-10-20T10:43:37.394298434Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84703","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-10-19T10:08:08Z","modified":"2026-10-20T10:17:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:73428","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n\n* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10] (JIRA:Rocky Linux-249187)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-01T12:08:49.381512Z","modified":"2026-10-01T12:30:03.431595929Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:73838","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n\n* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-249189)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-30T12:05:19.277561Z","modified":"2026-09-30T12:45:01.988771832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:74085","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n\n* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8.10.z] (JIRA:Rocky Linux-249188)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-01T00:01:35.97038Z","modified":"2026-10-01T00:30:02.661210725Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:75864","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-06T12:10:42.614631Z","modified":"2026-10-06T12:45:02.660842236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:75870","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-06T00:01:33.396362Z","modified":"2026-10-06T00:30:02.571248183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76750","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-08T12:05:18.82809Z","modified":"2026-10-08T12:30:02.535494174Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:96226","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627957336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:97855","title":"Important: nodejs:26 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)\n\n* nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)\n\n* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)\n\n* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)\n\n* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)\n\n* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\n* undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)\n\n* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n\n* nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)\n\n* nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)\n\n* nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)\n\n* nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)\n\n* nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)\n\n* nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)\n\n* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n\n* nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)\n\n* nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)\n\n* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n\n* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:04:11.284864Z","modified":"2026-11-11T12:45:02.299333759Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:00Z","modified":"2026-10-17T12:59:54.143123076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:73428","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-10-29T11:30:50.624046186Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:73838","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-29T11:32:37.764116021Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:74085","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-29T11:02:29.722116806Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:75864","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-29T11:30:50.223834554Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:75870","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-29T11:02:29.647630554Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76750","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:32:37.40786193Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1790719646","title":"TuxCare security update for undici (7 CVEs)","description":"TuxCare rebuilt undici to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.","status":"published","published":"2026-09-29T22:07:26Z","modified":"2026-10-25T01:30:03.52180706Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790756064","title":"TuxCare security update for undici (6 CVEs)","description":"TuxCare rebuilt undici to address 6 CVEs. Fixed in 7.28.0-tuxcare.3.","status":"published","published":"2026-09-30T08:14:24Z","modified":"2026-10-15T09:47:53.491974208Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790854776","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.28.0-tuxcare.1.","status":"published","published":"2026-10-01T11:39:36Z","modified":"2026-10-15T09:48:00.013670164Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790856988","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.20.0-tuxcare.1.","status":"published","published":"2026-10-01T12:16:28Z","modified":"2026-10-25T01:30:05.632788134Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790863423","title":"TuxCare security update for undici (2 CVEs)","description":"TuxCare rebuilt undici to address 2 CVEs. Fixed in 6.19.7-tuxcare.2.","status":"published","published":"2026-10-01T14:03:43Z","modified":"2026-10-15T09:48:04.016841944Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790895136","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.19.5-tuxcare.1.","status":"published","published":"2026-10-01T22:52:16Z","modified":"2026-10-15T09:47:57.85807989Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791668718","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.11.1-tuxcare.5.","status":"published","published":"2026-10-10T21:45:18Z","modified":"2026-10-15T09:46:04.053693816Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792478858","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.","status":"published","published":"2026-10-20T06:47:38Z","modified":"2026-11-05T13:28:26.36826201Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1792867308","title":"TuxCare security update for undici-types (7 CVEs)","description":"TuxCare rebuilt undici-types to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.","status":"published","published":"2026-10-24T18:41:47Z","modified":"2026-10-25T01:30:06.623556274Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792867311","title":"TuxCare security update for undici-types (1 CVE)","description":"TuxCare rebuilt undici-types to address 1 CVE. Fixed in 6.20.0-tuxcare.1.","status":"published","published":"2026-10-24T18:41:47Z","modified":"2026-10-25T01:30:02.451457616Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1794310630","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 7.24.8-tuxcare.1.","status":"published","published":"2026-11-10T12:37:11Z","modified":"2026-11-10T13:15:07.241296257Z","updated_at":"2026-11-10T13:29:51.103746Z"}]}}