Vulnerability-Lookup

RHSA-2026:71017

Vulnerability from csaf_redhat - Published: 2026-09-23 17:59 - Updated: 2026-10-02 02:16

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: nodejs24: * nodejs24-24.21.0-1.hum1 (aarch64, x86_64) * nodejs24-bin-24.21.0-1.hum1 (noarch) * nodejs24-devel-24.21.0-1.hum1 (aarch64, x86_64) * nodejs24-docs-24.21.0-1.hum1 (noarch) * nodejs24-full-i18n-24.21.0-1.hum1 (aarch64, x86_64) * nodejs24-libs-24.21.0-1.hum1 (aarch64, x86_64) * nodejs24-npm-11.19.0-1.24.21.0.1.hum1 (noarch) * nodejs24-npm-bin-11.19.0-1.24.21.0.1.hum1 (noarch) * v8-13.6-devel-13.6.233.17-1.24.21.0.1.hum1 (aarch64, x86_64) * nodejs24-24.21.0-1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-18540

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64		—	Workaround
Unresolved product id: Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64		—	Workaround

Threats

Impact Low

CVE-2026-19534

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 17 products, the same list as for CVE-2026-18540

Known not affected 2 products, the same list as for CVE-2026-18540

Threats

Impact Important

CVE-2026-85024

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-431 - Missing Handler

Affected products

Fixed 17 products, the same list as for CVE-2026-18540

Known not affected 2 products, the same list as for CVE-2026-18540

Threats

Impact Moderate

References

23 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:71017	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-19534	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-18540	external
https://access.redhat.com/security/cve/CVE-2026-85024	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-18540	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528783	external
https://www.cve.org/CVERecord?id=CVE-2026-18540	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18540	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-19534	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528759	external
https://www.cve.org/CVERecord?id=CVE-2026-19534	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19534	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-85024	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528707	external
https://www.cve.org/CVERecord?id=CVE-2026-85024	external
https://nvd.nist.gov/vuln/detail/CVE-2026-85024	external
https://github.com/nodejs/undici/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs24:\n  * nodejs24-24.21.0-1.hum1 (aarch64, x86_64)\n  * nodejs24-bin-24.21.0-1.hum1 (noarch)\n  * nodejs24-devel-24.21.0-1.hum1 (aarch64, x86_64)\n  * nodejs24-docs-24.21.0-1.hum1 (noarch)\n  * nodejs24-full-i18n-24.21.0-1.hum1 (aarch64, x86_64)\n  * nodejs24-libs-24.21.0-1.hum1 (aarch64, x86_64)\n  * nodejs24-npm-11.19.0-1.24.21.0.1.hum1 (noarch)\n  * nodejs24-npm-bin-11.19.0-1.24.21.0.1.hum1 (noarch)\n  * v8-13.6-devel-13.6.233.17-1.24.21.0.1.hum1 (aarch64, x86_64)\n  * nodejs24-24.21.0-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:71017",
        "url": "https://access.redhat.com/errata/RHSA-2026:71017"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19534",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18540",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18540"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85024",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71017.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-02T02:16:16+00:00",
      "generator": {
        "date": "2026-10-02T02:16:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:71017",
      "initial_release_date": "2026-09-23T17:59:20+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T17:59:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-29T13:43:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T02:16:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-0:24.21.0-1.hum1@aarch64",
                "product": {
                  "name": "nodejs24-0:24.21.0-1.hum1@aarch64",
                  "product_id": "nodejs24-0:24.21.0-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.21.0-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-0:24.21.0-1.hum1@aarch64",
                "product": {
                  "name": "nodejs24-devel-0:24.21.0-1.hum1@aarch64",
                  "product_id": "nodejs24-devel-0:24.21.0-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.21.0-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
                "product": {
                  "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
                  "product_id": "nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.21.0-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-0:24.21.0-1.hum1@aarch64",
                "product": {
                  "name": "nodejs24-libs-0:24.21.0-1.hum1@aarch64",
                  "product_id": "nodejs24-libs-0:24.21.0-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.21.0-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
                "product": {
                  "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
                  "product_id": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.21.0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-0:24.21.0-1.hum1@src",
                "product": {
                  "name": "nodejs24-0:24.21.0-1.hum1@src",
                  "product_id": "nodejs24-0:24.21.0-1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.21.0-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-0:24.21.0-1.hum1@x86_64",
                "product": {
                  "name": "nodejs24-0:24.21.0-1.hum1@x86_64",
                  "product_id": "nodejs24-0:24.21.0-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.21.0-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-0:24.21.0-1.hum1@x86_64",
                "product": {
                  "name": "nodejs24-devel-0:24.21.0-1.hum1@x86_64",
                  "product_id": "nodejs24-devel-0:24.21.0-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.21.0-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
                "product": {
                  "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
                  "product_id": "nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.21.0-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-0:24.21.0-1.hum1@x86_64",
                "product": {
                  "name": "nodejs24-libs-0:24.21.0-1.hum1@x86_64",
                  "product_id": "nodejs24-libs-0:24.21.0-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.21.0-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64",
                "product": {
                  "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64",
                  "product_id": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.21.0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-bin@24.21.0-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-bin@24.21.0-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-docs@24.21.0-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-docs@24.21.0-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-npm@11.19.0-1.24.21.0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-npm@11.19.0-1.24.21.0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-npm-bin@11.19.0-1.24.21.0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-npm-bin@11.19.0-1.24.21.0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-0:24.21.0-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64"
        },
        "product_reference": "nodejs24-0:24.21.0-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-0:24.21.0-1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src"
        },
        "product_reference": "nodejs24-0:24.21.0-1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-0:24.21.0-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64"
        },
        "product_reference": "nodejs24-0:24.21.0-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-0:24.21.0-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64"
        },
        "product_reference": "nodejs24-devel-0:24.21.0-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-0:24.21.0-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64"
        },
        "product_reference": "nodejs24-devel-0:24.21.0-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64"
        },
        "product_reference": "nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64"
        },
        "product_reference": "nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-0:24.21.0-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64"
        },
        "product_reference": "nodejs24-libs-0:24.21.0-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-0:24.21.0-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64"
        },
        "product_reference": "nodejs24-libs-0:24.21.0-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64"
        },
        "product_reference": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
        },
        "product_reference": "v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18540",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-04T17:26:35.687862+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: HTTP response splitting via retry interceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in the undici HTTP client\u0027s retry interceptor can lead to HTTP response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards responses without proper framing normalization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18540",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
        }
      ],
      "release_date": "2026-09-04T17:15:50.619000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T17:59:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71017"
        },
        {
          "category": "workaround",
          "details": "Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0 on the retry interceptor configuration. Alternatively, remove or recalculate the Content-Length header before forwarding a response body assembled by undici to downstream HTTP/1.1 peers.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "undici: undici: HTTP response splitting via retry interceptor"
    },
    {
      "cve": "CVE-2026-19534",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-09-04T17:21:01.599799+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528759"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528759",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
        }
      ],
      "release_date": "2026-09-04T17:10:05.081000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T17:59:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71017"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
    },
    {
      "cve": "CVE-2026-85024",
      "cwe": {
        "id": "CWE-431",
        "name": "Missing Handler"
      },
      "discovery_date": "2026-09-04T16:32:04.089014+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw exists in the undici WebSocket client, which is used by Node.js. A remote, unauthenticated attacker can send a specially crafted compressed WebSocket message that, upon decompression, exceeds a size limit and contains a malformed DEFLATE block. This can lead to an unhandled error and terminate the Node.js process, causing a denial of service. The attack is asymmetric, allowing a small on-wire payload to crash the process, and can be repeated upon reconnection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
          "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85024",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"
        }
      ],
      "release_date": "2026-09-04T16:20:34.709000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T17:59:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71017"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@src",
            "Red Hat Hardened Images:nodejs24-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-bin-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-devel-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-docs-0:24.21.0-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-full-i18n-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs24-libs-0:24.21.0-1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs24-npm-bin-0:11.19.0-1.24.21.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-13.6-devel-0:13.6.233.17-1.24.21.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression"
    }
  ]
}

CVE-2026-18540 (GCVE-0-2026-18540)

Vulnerability from cvelistv5 – Published: 2026-09-04 17:15 – Updated: 2026-09-04 17:50

Title

undici vulnerable to downstream response splitting via retry interceptor

Summary

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 17:50 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

openjs redhat root Scorecard

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.28.1 (semver) Unaffected: 6.28.1 (semver) Affected: 7.0.0 , < 7.29.1 (semver) Unaffected: 7.29.1 (semver) Affected: 8.0.0 , < 8.10.2 (semver) Unaffected: 8.10.2 (semver)

Credits

samuel871211 mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18540",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:50:05.851866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T17:50:13.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.28.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.28.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.29.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "samuel871211"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici\u0027s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response\u0027s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
            }
          ],
          "value": "undici\u0027s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response\u0027s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:15:50.619Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to downstream response splitting via retry interceptor",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-18540",
    "datePublished": "2026-09-04T17:15:50.619Z",
    "dateReserved": "2026-07-31T20:47:28.965Z",
    "dateUpdated": "2026-09-04T17:50:13.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19534 (GCVE-0-2026-19534)

Vulnerability from cvelistv5 – Published: 2026-09-04 17:10 – Updated: 2026-09-04 18:18

Title

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Summary

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 18:18 UTC

CWE

CWE-248 - Uncaught Exception
CWE-252 - Unchecked Return Value

Assigner

openjs redhat root Scorecard

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 6.7.0 , < 6.28.1 (semver) Unaffected: 6.28.1 (semver) Affected: 7.0.0 , < 7.29.1 (semver) Unaffected: 7.29.1 (semver) Affected: 8.0.0 , < 8.10.2 (semver) Unaffected: 8.10.2 (semver)

Credits

manus-use mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19534",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T18:18:18.694757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:18:31.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.28.1",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.28.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.29.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-use"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici\u0027s WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server\u0027s 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node\u0027s default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
            }
          ],
          "value": "undici\u0027s WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server\u0027s 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node\u0027s default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252: Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:10:05.081Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-19534",
    "datePublished": "2026-09-04T17:10:05.081Z",
    "dateReserved": "2026-08-11T09:36:47.101Z",
    "dateUpdated": "2026-09-04T18:18:31.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85024 (GCVE-0-2026-85024)

Vulnerability from cvelistv5 – Published: 2026-09-04 16:20 – Updated: 2026-09-04 19:30

Title

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

Summary

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:30 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

openjs redhat root Scorecard

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 6.25.0 , < 6.28.1 (semver) Unaffected: 6.28.1 (semver) Affected: 7.28.0 , < 7.29.1 (semver) Unaffected: 7.29.1 (semver) Affected: 8.1.0 , < 8.10.2 (semver) Unaffected: 8.10.2 (semver)

Credits

mcollina krsecu UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:30:33.342541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:30:54.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.28.1",
              "status": "affected",
              "version": "6.25.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.28.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.29.1",
              "status": "affected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "krsecu"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
            }
          ],
          "value": "undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:20:34.709Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-85024",
    "datePublished": "2026-09-04T16:20:34.709Z",
    "dateReserved": "2026-09-02T19:57:23.011Z",
    "dateUpdated": "2026-09-04T19:30:54.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:71017

CVE-2026-18540 (GCVE-0-2026-18540)

CVE-2026-19534 (GCVE-0-2026-19534)

CVE-2026-85024 (GCVE-0-2026-85024)

Tags

Sightings

Nomenclature

Related by attack behaviour