Red Hat Security Advisory

RHSA-2026:38009

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images nodejs26-1:26.5.0-1.3.hum1@aarch64, nodejs26-1:26.5.0-1.3.hum1@src, nodejs26-1:26.5.0-1.3.hum1@x86_64 +14

Fixes 3 records

TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

MEDIUM 40

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00789 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-400

TI-2026-08490 CVE-2026-9679 · GHSA-p88m-4jfj-68fv

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

LOW 26

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00257 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-93

TI-2026-05899 CVE-2026-6733 · GHSA-35p6-xmwp-9g52

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

LOW 17

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0022 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-367