Red Hat Security AdvisoryRHSA-2026:74085
nodejs:24 security, bug fix, and enhancement update
Released 2026-09-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.21.0-1.module+el8.10.0+24927+ed3d907a.aarch64::nodejs:24, nodejs-1:24.21.0-1.module+el8.10.0+24927+ed3d907a.ppc64le::nodejs:24, nodejs-1:24.21.0-1.module+el8.10.0+24927+ed3d907a.s390x::nodejs:24 +25
Fixes 3 records
Priority MEDIUM 40
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00178 · Published 2026-09-04 · Partial fix · 7.29.1, 8.10.2 CWE-295
Priority LOW 39
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-09-04 · Partial fix · 6.28.1, 7.29.1 +1 CWE-248
Priority LOW 34
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00164 · Published 2026-09-04 · Partial fix · 8.10.2 CWE-346
