{"id":"CVE-2026-87018","aliases":["ALSA-2026:96088","ALSA-2026:96094","ALSA-2026:96234","CLSA-2026-1793973288","CLSA-2026-1793973612","CLSA-2026-1793973732","CLSA-2026-1793973854","CLSA-2026-1794216395","CLSA-2026-1794219500","CLSA-2026-1794229555","CLSA-2026-1794229582","CLSA-2026-1794229707","CLSA-2026-1794250511","CLSA-2026-1794250627","CLSA-2026-1794299321","CLSA-2026-1794310630","DEBIAN-CVE-2026-87018","EUVD-2026-102318","GHSA-qrxm-fqhp-jwvm","RHSA-2026:84657","RHSA-2026:84706","RLSA-2026:96088","RLSA-2026:96094","RLSA-2026:96226","RLSA-2026:96234","UBUNTU-CVE-2026-87018","openSUSE-SU-2026:12421-1"],"status":"published","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00187,"percentile":0.08365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-617"],"published":"2026-10-15T18:38:25Z","modified":"2026-11-10T13:15:07Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["6.29.1","7.30.1","8.12.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["6.11.1-tuxcare.10","5.28.5-tuxcare.12","6.19.7-tuxcare.7","6.28.0-tuxcare.6","6.20.0-tuxcare.6","6.28.1-tuxcare.2","7.24.4-tuxcare.8","7.29.0-tuxcare.9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.12.2+dfsg+~cs3.2.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.1"},{"fixed":"6.29.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.30.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.12.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.1-1.24.22.1.3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.9-1.22.23.4.1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.10"}]}],"versions":["6.11.1","6.11.1-tuxcare.1","6.11.1-tuxcare.2","6.11.1-tuxcare.3","6.11.1-tuxcare.4","6.11.1-tuxcare.5","6.11.1-tuxcare.6","6.11.1-tuxcare.7","6.11.1-tuxcare.8","6.11.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.29.0-tuxcare.0"},{"fixed":"5.29.0-tuxcare.9"}]}],"versions":["5.29.0","5.29.0-tuxcare.1","5.29.0-tuxcare.2","5.29.0-tuxcare.3","5.29.0-tuxcare.4","5.29.0-tuxcare.5","5.29.0-tuxcare.6","5.29.0-tuxcare.7","5.29.0-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.28.5-tuxcare.0"},{"fixed":"5.28.5-tuxcare.12"}]}],"versions":["5.28.5","5.28.5-tuxcare.1","5.28.5-tuxcare.10","5.28.5-tuxcare.11","5.28.5-tuxcare.2","5.28.5-tuxcare.3","5.28.5-tuxcare.4","5.28.5-tuxcare.5","5.28.5-tuxcare.6","5.28.5-tuxcare.7","5.28.5-tuxcare.8","5.28.5-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1-tuxcare.0"},{"fixed":"5.5.1-tuxcare.4"}]}],"versions":["5.5.1","5.5.1-tuxcare.1","5.5.1-tuxcare.2","5.5.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.7"}]}],"versions":["6.19.5","6.19.5-tuxcare.1","6.19.5-tuxcare.2","6.19.5-tuxcare.3","6.19.5-tuxcare.4","6.19.5-tuxcare.5","6.19.5-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.7"}]}],"versions":["6.19.7","6.19.7-tuxcare.1","6.19.7-tuxcare.2","6.19.7-tuxcare.3","6.19.7-tuxcare.4","6.19.7-tuxcare.5","6.19.7-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.28.0-tuxcare.0"},{"fixed":"6.28.0-tuxcare.6"}]}],"versions":["6.28.0","6.28.0-tuxcare.1","6.28.0-tuxcare.2","6.28.0-tuxcare.3","6.28.0-tuxcare.4","6.28.0-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.6"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2","6.20.0-tuxcare.3","6.20.0-tuxcare.4","6.20.0-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.28.1-tuxcare.0"},{"fixed":"6.28.1-tuxcare.2"}]}],"versions":["6.28.1","6.28.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.8"}]}],"versions":["7.24.4","7.24.4-tuxcare.1","7.24.4-tuxcare.2","7.24.4-tuxcare.3","7.24.4-tuxcare.4","7.24.4-tuxcare.5","7.24.4-tuxcare.6","7.24.4-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.10"}]}],"versions":["7.28.0","7.28.0-tuxcare.1","7.28.0-tuxcare.2","7.28.0-tuxcare.3","7.28.0-tuxcare.4","7.28.0-tuxcare.5","7.28.0-tuxcare.6","7.28.0-tuxcare.7","7.28.0-tuxcare.8","7.28.0-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.29.0-tuxcare.0"},{"fixed":"7.29.0-tuxcare.9"}]}],"versions":["7.29.0","7.29.0-tuxcare.1","7.29.0-tuxcare.2","7.29.0-tuxcare.3","7.29.0-tuxcare.4","7.29.0-tuxcare.5","7.29.0-tuxcare.6","7.29.0-tuxcare.7","7.29.0-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.8-tuxcare.0"},{"fixed":"7.24.8-tuxcare.1"}]}],"versions":["7.24.8"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-1","8.12.2+dfsg+~cs3.2.3-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.2+dfsg+~cs3.2.3-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.12.1+dfsg+~cs3.2.3-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.1"},{"fixed":"6.29.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.30.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.12.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.20.0-1.26.11.1.0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.11.1.0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.21.0.1.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pi-coding-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v6.29.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.30.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.12.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qrxm-fqhp-jwvm"},{"url":"https://access.redhat.com/errata/RHSA-2026:96088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109829","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109869","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553679","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96088.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96094","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96094.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96234","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96234.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87018.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87018","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84657","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109841","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87029","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84657.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87018","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/f75eac00ac17","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/26c2bfb3def0","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/4f7ef6806e53","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/b5084c7dc239","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/789ef26461c","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84706","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84706.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96088","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96094","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96226","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563978","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96226","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96234","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87018","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-112366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87018","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-87018","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T18:38:25.613Z","modified":"2026-10-16T20:01:29.402Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248","CWE-617"],"updated_at":"2026-11-02T13:37:36.275898Z"}],"euvd":[{"id":"EUVD-2026-102318","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T18:38:25Z","modified":"2026-10-16T20:01:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:01.858348Z"}],"ghsa":[{"id":"GHSA-qrxm-fqhp-jwvm","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","description":"## Impact\n\nundici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with `ERR_TLS_CERT_ALTNAME_INVALID`. undici's established socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught `AssertionError` that terminates the Node.js process. Both the HTTP/1.1 and HTTP/2 paths are affected.\n\nA malicious or compromised HTTPS endpoint reached through undici or the global `fetch()` can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process. Only TLS 1.2 is affected, because TLS 1.3 does not support renegotiation. Exploitation does not require a CA compromise: the attacker controls the endpoint and can present two ordinary valid certificates, the first matching the requested URL and the second intentionally not matching it.\n\n## Patches\n\nUpgrade to undici 6.29.1, 7.30.1, or 8.12.2.\n\n## Workarounds\n\nRestrict outbound connections to TLS 1.3, for example by setting `connect: { minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3' }` on the client or agent, so that renegotiation cannot occur, when the target endpoints support TLS 1.3.","status":"published","published":"2026-10-27T19:02:21Z","modified":"2026-10-27T19:02:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-617"],"updated_at":"2026-11-02T14:41:38.969831Z"}],"nvd":[{"id":"CVE-2026-87018","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T19:17:46.6Z","modified":"2026-10-19T20:41:16.643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248","CWE-617"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-87018","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T18:38:25.613Z","modified":"2026-11-10T12:12:22.57415122Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-617"],"updated_at":"2026-11-10T11:27:53.515768Z"},{"id":"DEBIAN-CVE-2026-87018","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T19:17:46.6Z","modified":"2026-11-01T05:00:07.475601773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"GHSA-qrxm-fqhp-jwvm","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","description":"## Impact\n\nundici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with `ERR_TLS_CERT_ALTNAME_INVALID`. undici's established socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught `AssertionError` that terminates the Node.js process. Both the HTTP/1.1 and HTTP/2 paths are affected.\n\nA malicious or compromised HTTPS endpoint reached through undici or the global `fetch()` can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process. Only TLS 1.2 is affected, because TLS 1.3 does not support renegotiation. Exploitation does not require a CA compromise: the attacker controls the endpoint and can present two ordinary valid certificates, the first matching the requested URL and the second intentionally not matching it.\n\n## Patches\n\nUpgrade to undici 6.29.1, 7.30.1, or 8.12.2.\n\n## Workarounds\n\nRestrict outbound connections to TLS 1.3, for example by setting `connect: { minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3' }` on the client or agent, so that renegotiation cannot occur, when the target endpoints support TLS 1.3.","status":"published","published":"2026-10-27T19:02:21Z","modified":"2026-10-27T19:15:22.403573595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-617"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"RHSA-2026:84657","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-20T10:17:41Z","modified":"2026-10-20T10:43:33.48989051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84706","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-20T10:17:45Z","modified":"2026-10-20T10:43:36.699091514Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486941765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.483801869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96226","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627957336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627933753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"UBUNTU-CVE-2026-87018","description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","status":"published","published":"2026-10-15T19:17:00Z","modified":"2026-10-28T17:43:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.3776558Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.399791109Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T10:45:02.706366594Z","updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"CLSA-2026-1793973288","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.11.1-tuxcare.10.","status":"published","published":"2026-11-06T14:54:49Z","modified":"2026-11-06T19:00:03.390646286Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973612","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 5.29.0-tuxcare.9.","status":"published","published":"2026-11-06T15:00:13Z","modified":"2026-11-06T19:00:02.361882663Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973732","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.12.","status":"published","published":"2026-11-06T15:02:13Z","modified":"2026-11-06T19:00:02.36432499Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973854","title":"TuxCare security update for undici (2 CVEs)","description":"TuxCare rebuilt undici to address 2 CVEs. Fixed in 5.5.1-tuxcare.4.","status":"published","published":"2026-11-06T15:04:15Z","modified":"2026-11-06T19:00:04.388579885Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794216395","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 6.19.5-tuxcare.7.","status":"published","published":"2026-11-09T10:26:36Z","modified":"2026-11-09T19:15:16.075552233Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794219500","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.19.7-tuxcare.7.","status":"published","published":"2026-11-09T11:18:21Z","modified":"2026-11-09T19:15:16.080460433Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229555","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.28.0-tuxcare.6.","status":"published","published":"2026-11-09T14:05:56Z","modified":"2026-11-09T19:15:16.085752569Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229582","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.20.0-tuxcare.6.","status":"published","published":"2026-11-09T14:06:23Z","modified":"2026-11-09T19:15:14.72718014Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229707","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.28.1-tuxcare.2.","status":"published","published":"2026-11-09T14:08:28Z","modified":"2026-11-09T19:15:16.088453055Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794250511","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.24.4-tuxcare.8.","status":"published","published":"2026-11-09T19:55:12Z","modified":"2026-11-10T01:15:03.460360604Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794250627","title":"TuxCare security update for undici (5 CVEs)","description":"TuxCare rebuilt undici to address 5 CVEs. Fixed in 7.28.0-tuxcare.10.","status":"published","published":"2026-11-09T19:57:08Z","modified":"2026-11-10T01:15:04.448136089Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794299321","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.29.0-tuxcare.9.","status":"published","published":"2026-11-10T09:28:42Z","modified":"2026-11-10T13:15:05.390386193Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794310630","title":"TuxCare security update for undici (14 CVEs)","description":"TuxCare rebuilt undici to address 14 CVEs. Fixed in 7.24.8-tuxcare.1.","status":"published","published":"2026-11-10T12:37:11Z","modified":"2026-11-10T13:15:07.241296257Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"openSUSE-SU-2026:12421-1","title":"pi-coding-agent-1.5.0-1.1 on GA media","description":"These are all security issues fixed in the pi-coding-agent-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-04T00:00:00Z","modified":"2026-11-05T17:23:17.528992504Z","updated_at":"2026-11-05T17:55:05.69587Z"}]}}