https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T16:39:24.741717+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/alsa-2026:73428 ALSA-2026:73428 — Important: nodejs24 security, bug fix, and enhancement update 2026-09-30T16:39:24.891961+00:00

Affected: AlmaLinux:10: nodejs24, AlmaLinux:10: nodejs24-devel, AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-full-i18n, AlmaLinux:10: nodejs24-libs, AlmaLinux:10: nodejs24-npm

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-09-30T16:39:24.892142+00:00 certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/cleanstart-2026-nt71796 CLEANSTART-2026-NT71796 — undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and r… 2026-09-30T16:39:24.892186+00:00

Affected: CleanStart: langfuse

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84961 fkie_cve-2026-84961 2026-09-30T16:39:24.892229+00:00

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

 https://vulnerability.circl.lu/vuln/ghsa-w293-vg96-wgc3 GHSA-w293-vg96-wgc3 — undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool 2026-09-30T16:39:24.892281+00:00

Affected: npm: undici

### Impact

undici's `BalancedPool` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-upstream `Pool`. JSON cannot represent functions, so a caller-supplied `connect` or `tls` option containing a `checkServerIdentity` callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom `checkServerIdentity` was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through `BalancedPool`. `Client`, `Pool`, `Agent`, and `RoundRobinPool` destructure `connect`/`tls` before the clone and are not affected. Only applications that use `BalancedPool` with a function-valued `connect`/`tls` option (such as a custom `checkServerIdentity` or connector) are affected.

### Patches

Upgrade to `7.29.1` or `8.10.2`. `BalancedPool` now preserves the `connect` and `tls` options outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.

### Workarounds

Use `Client`, `Pool`, or `Agent` instead of `BalancedPool` for connections that rely on a custom `checkServerIdentity` or connector, until upgraded.

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11884-1 openSUSE-SU-2026:11884-1 — pi-coding-agent-0.87.1-1.1 on GA media 2026-09-30T16:39:24.892356+00:00

pi-coding-agent-0.87.1-1.1 on GA media

 https://vulnerability.circl.lu/vuln/rhsa-2026:54438 RHSA-2026:54438 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-09-30T16:39:24.892400+00:00

undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

 https://vulnerability.circl.lu/vuln/rlsa-2026:73838 RLSA-2026:73838 — Important: nodejs:24 security, bug fix, and enhancement update 2026-09-30T16:39:24.892458+00:00

Affected: Rocky Linux:9: nodejs-nodemon, Rocky Linux:9: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-84961 UBUNTU-CVE-2026-84961 2026-09-30T16:39:24.892521+00:00

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.