TI-2026-35963 CVE-2026-48617 · GHSA-rv82-5vqw-69hj
Improper access control in NodeJS node
Priority LOW 36
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.
RHSA-2026:45783
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-07-25 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs26-1:26.5.0-1.5.hum1@aarch64, nodejs26-1:26.5.0-1.5.hum1@src, nodejs26-1:26.5.0-1.5.hum1@x86_64 +14
Fixes 2 records
TI-2026-09954 CVE-2026-11525 · GHSA-g8m3-5g58-fq7m
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Priority LOW 17
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.