TI-2026-74888 CVE-2026-109829 · GHSA-4w7w-5xrc-9h26
undici cache poisoning and cross-user disclosure via cross-origin redirects
Priority MEDIUM 40
undici is an HTTP client library for Node.js.
RHSA-2026:84657
Red Hat Hardened Images RPMs Security Update
Released 2026-10-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs26-26.11.1-0.4.hum1@aarch64, nodejs26-26.11.1-0.4.hum1@s390x, nodejs26-26.11.1-0.4.hum1@src +25
Fixes 9 records
TI-2026-74886 CVE-2026-109383 · GHSA-2m5v-pch6-74hx
Certificate validation bypass in undici Agent drops custom TLS checks
Priority MEDIUM 40
undici is an HTTP client library for Node.js.
TI-2026-74890 CVE-2026-109869 · GHSA-xjj6-f33q-929c
Unhandled error in undici fetch() crashes Node.js process
Priority LOW 39
undici is an HTTP client library for Node.js.
TI-2026-65311 CVE-2026-102276 · GHSA-6j4f-fj2g-mc7p
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Priority LOW 39
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-74992 CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
Denial of service in undici via TLS renegotiation
Priority LOW 38
undici is an HTTP client library for Node.js.
TI-2026-74894 CVE-2026-109932 · GHSA-9fm3-97px-rjf6
Undici WebSocket client exhausts memory via unbounded PONG buffering
Priority LOW 33
undici is an HTTP client library for Node.js.
TI-2026-74893 CVE-2026-109924 · GHSA-4qv8-2p9j-2685
Unbounded memory in undici EventSource parser allows denial of service
Priority LOW 33
undici is an HTTP client library for Node.js.
TI-2026-74993 CVE-2026-87029 · GHSA-55wc-3pg8-jfw6
Uncaught exception in undici decompress interceptor allows crashes
Priority LOW 32
undici is an HTTP client library for Node.js.
TI-2026-74889 CVE-2026-109841 · GHSA-f72v-6w45-q472
Subresource Integrity bypass in undici fetch via mixed-case tokens
Priority LOW 32
undici is an HTTP client library for Node.js.