Red Hat Security AdvisoryRHSA-2026:73428
nodejs24 security, bug fix, and enhancement update
Released 2026-09-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.21.0-1.el10_2, nodejs24-devel-1:24.21.0-1.el10_2, nodejs24-docs-1:24.21.0-1.el10_2 +3
Fixes 3 records
Priority MEDIUM 40
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00178 · Published 2026-09-04 · Partial fix · 7.29.1, 8.10.2 CWE-295
Priority LOW 39
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-09-04 · Partial fix · 6.28.1, 7.29.1 +1 CWE-248
Priority LOW 34
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00164 · Published 2026-09-04 · Partial fix · 8.10.2 CWE-346
