Vulnerability-Lookup

CVE-2026-85152 (GCVE-0-2026-85152)

Vulnerability from cvelistv5 – Published: 2026-09-04 16:36 – Updated: 2026-09-04 19:29

Title

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Summary

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:29 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

openjs CNA under the redhat root

CNA scorecard C 65/100 over 121 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version	CPE status
undici	undici	Affected: 8.10.0 , < 8.10.2 (semver) Unaffected: 8.10.2 (semver)	guessed

Credits

nikolakojic-rasit mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:29:18.959401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:29:29.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "nikolakojic-rasit"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
            }
          ],
          "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:36:28.085Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-85152",
    "datePublished": "2026-09-04T16:36:28.085Z",
    "dateReserved": "2026-09-03T10:34:23.057Z",
    "dateUpdated": "2026-09-04T19:29:29.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-85152",
      "date": "2026-10-30",
      "epss": "0.00164",
      "percentile": "0.05639"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:npm/undici",
                "product": "undici",
                "vendor": "undici",
                "versions": [
                  {
                    "lessThan": "8.10.2",
                    "status": "affected",
                    "version": "8.10.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "8.10.2",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "CCB57D1E-09C0-47AA-B4D4-2BB5380F8F51",
                    "versionEndExcluding": "8.10.2",
                    "versionStartIncluding": "8.10.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
          }
        ],
        "id": "CVE-2026-85152",
        "lastModified": "2026-09-16T20:41:35.683",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.2,
              "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-85152",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:29:18.959401Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-04T17:17:02.717",
        "references": [
          {
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://cna.openjsf.org/security-advisories.html"
          },
          {
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
          }
        ],
        "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-29T17:44:20+00:00",
      "cve": "CVE-2026-85152",
      "id": "CVE-2026-85152",
      "initial_release_date": "2026-09-04T16:36:28.085000+00:00",
      "product_status:fixed": "198",
      "product_status:known_affected": "55",
      "product_status:known_not_affected": "944",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85152.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-16T23:49:17Z",
      "cve": "CVE-2026-85152",
      "id": "CVE-2026-85152",
      "initial_release_date": "2026-09-08T23:57:06Z",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "223",
      "product_status:recommended": "26",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-85152",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-85152.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85152",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T19:29:18.959401Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T19:29:25.616Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/undici",
              "product": "undici",
              "vendor": "undici",
              "versions": [
                {
                  "lessThan": "8.10.2",
                  "status": "affected",
                  "version": "8.10.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "8.10.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "nikolakojic-rasit"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "mcollina"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "UlisesGascon"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
                }
              ],
              "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346: Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T16:36:28.085Z",
            "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
            "shortName": "openjs"
          },
          "references": [
            {
              "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
            },
            {
              "url": "https://cna.openjsf.org/security-advisories.html"
            }
          ],
          "title": "undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors",
          "x_generator": {
            "engine": "cve-kit 1.0.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "assignerShortName": "openjs",
        "cveId": "CVE-2026-85152",
        "datePublished": "2026-09-04T16:36:28.085Z",
        "dateReserved": "2026-09-03T10:34:23.057Z",
        "dateUpdated": "2026-09-04T19:29:29.802Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2026:73428 (CVE-2026-19534)

Vulnerability from osv_almalinux – Published: 2026-09-29 00:00 – Updated: 2026-09-30 12:14 – Source website

Summary

Important: nodejs24 security, bug fix, and enhancement update

Details

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:73428	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-19534	REPORT
	https://access.redhat.com/security/cve/CVE-2026-84961	REPORT
	https://access.redhat.com/security/cve/CVE-2026-85152	REPORT
	https://bugzilla.redhat.com/2528735	REPORT
	https://bugzilla.redhat.com/2528759	REPORT
	https://errata.almalinux.org/10/ALSA-2026-73428.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24-docs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24-full-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "nodejs24-npm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:11.19.0-1.24.21.0.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:73428",
  "modified": "2026-09-30T12:14:50Z",
  "published": "2026-09-29T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:73428"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528735"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528759"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-73428.html"
    }
  ],
  "related": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: nodejs24 security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ]
}

ALSA-2026:73838 (CVE-2026-19534)

Vulnerability from osv_almalinux – Published: 2026-09-30 00:00 – Updated: 2026-10-15 09:30 – Source website

Summary

Important: nodejs:24 security, bug fix, and enhancement update

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:73838	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-19534	REPORT
	https://access.redhat.com/security/cve/CVE-2026-84961	REPORT
	https://access.redhat.com/security/cve/CVE-2026-85152	REPORT
	https://bugzilla.redhat.com/2528717	REPORT
	https://bugzilla.redhat.com/2528735	REPORT
	https://bugzilla.redhat.com/2528759	REPORT
	https://errata.almalinux.org/9/ALSA-2026-73838.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-docs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-full-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-nodemon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.14-3.module_el9.8.0+292+f4eaf8b2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-packaging"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.06-6.module_el9.7.0+209+ecf6523e"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "nodejs-packaging-bundler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.06-6.module_el9.7.0+209+ecf6523e"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "npm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "v8-13.6-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:73838",
  "modified": "2026-10-15T09:30:13Z",
  "published": "2026-09-30T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:73838"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528717"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528735"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528759"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-73838.html"
    }
  ],
  "related": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: nodejs:24 security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ]
}

ALSA-2026:74085 (CVE-2026-19534)

Vulnerability from osv_almalinux – Published: 2026-09-30 00:00 – Updated: 2026-10-14 13:07 – Source website

Summary

Important: nodejs:24 security, bug fix, and enhancement update

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:74085	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-19534	REPORT
	https://access.redhat.com/security/cve/CVE-2026-84961	REPORT
	https://access.redhat.com/security/cve/CVE-2026-85152	REPORT
	https://bugzilla.redhat.com/2528717	REPORT
	https://bugzilla.redhat.com/2528735	REPORT
	https://bugzilla.redhat.com/2528759	REPORT
	https://errata.almalinux.org/8/ALSA-2026-74085.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-docs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-full-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:24.21.0-1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-nodemon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.14-2.module_el8.10.0+4250+09238ed4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-packaging"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.06-6.module_el8.10.0+4086+70facd4a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "nodejs-packaging-bundler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.06-6.module_el8.10.0+4086+70facd4a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "npm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "v8-13.6-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n  * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n  * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8.10.z] (JIRA:AlmaLinux-249188)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:74085",
  "modified": "2026-10-14T13:07:44Z",
  "published": "2026-09-30T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:74085"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528717"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528735"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528759"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-74085.html"
    }
  ],
  "related": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: nodejs:24 security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-19534",
    "CVE-2026-84961",
    "CVE-2026-85152"
  ]
}

FKIE_CVE-2026-85152

Vulnerability from fkie_nvd - Published: 2026-09-04 17:17 - Updated: 2026-09-16 20:41

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	ce714d77-add3-4f53-aff5-83d477b104bb	https://cna.openjsf.org/security-advisories.html	Vendor Advisory
	ce714d77-add3-4f53-aff5-83d477b104bb	https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm	Vendor Advisory

Impacted products

	Vendor	Product	Version
	nodejs	undici	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "CCB57D1E-09C0-47AA-B4D4-2BB5380F8F51",
              "versionEndExcluding": "8.10.2",
              "versionStartIncluding": "8.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2."
    }
  ],
  "id": "CVE-2026-85152",
  "lastModified": "2026-09-16T20:41:35.683",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85152",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-04T19:29:18.959401Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-04T17:17:02.717",
  "references": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
    }
  ],
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "type": "Secondary"
    }
  ]
}

GHSA-VP8M-P9JH-Q5PM

Vulnerability from github – Published: 2026-09-29 18:15 – Updated: 2026-09-29 18:15

Summary

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Details

Impact

When interceptors.cache() or interceptors.deduplicate() is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together.

An attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers match. This allows cross-origin information disclosure and persistent cache poisoning, including chains such as JWKS cache poisoning where a token signed with an attacker-held key is accepted as belonging to a trusted issuer.

Applications that share interceptors.cache() or interceptors.deduplicate() state across origins are affected. An Agent is not affected, because its dispatch options include the request origin.

This was introduced in undici 8.10.0 and affects 8.10.0 and 8.10.1.

Patches

Upgrade to undici v8.10.2.

Workarounds

Use a separate cache store and a separate interceptor instance for each origin, and do not share them across origins.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "undici"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.10.0"
            },
            {
              "fixed": "8.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T18:15:13Z",
    "nvd_published_at": "2026-09-04T17:17:02Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\nWhen `interceptors.cache()` or `interceptors.deduplicate()` is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own `origin`, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together.\n\nAn attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers match. This allows cross-origin information disclosure and persistent cache poisoning, including chains such as JWKS cache poisoning where a token signed with an attacker-held key is accepted as belonging to a trusted issuer.\n\nApplications that share `interceptors.cache()` or `interceptors.deduplicate()` state across origins are affected. An `Agent` is not affected, because its dispatch options include the request origin.\n\nThis was introduced in undici 8.10.0 and affects 8.10.0 and 8.10.1.\n\n## Patches\n\nUpgrade to undici v8.10.2.\n\n## Workarounds\n\nUse a separate cache store and a separate interceptor instance for each origin, and do not share them across origins.",
  "id": "GHSA-vp8m-p9jh-q5pm",
  "modified": "2026-09-29T18:15:13Z",
  "published": "2026-09-29T18:15:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/commit/caf6194d3dae989b731ed87ab85f182befe5eb80"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nodejs/undici"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/releases/tag/v8.10.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors"
}

OPENSUSE-SU-2026:22111-1

Vulnerability from csaf_opensuse - Published: 2026-10-09 15:27 - Updated: 2026-10-19 17:25

Summary

Security update for pi-coding-agent

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2026-85152.

CVE-2026-85152

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Recommended: 2 products

Open the full advisory

RHSA-2026:73428

Vulnerability from csaf_opensuse - Published: 2026-09-29 20:26 - Updated: 2026-10-30 07:11

Summary

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2026-85152.

CVE-2026-85152

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fixed: 31 products

https://access.redhat.com/errata/RHSA-2026:73428

Open the full advisory

RHSA-2026:54389

Vulnerability from csaf_redhat - Published: 2026-08-12 14:18 - Updated: 2026-10-30 06:44

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2026-85152.

CVE-2026-85152

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fixed: 17 products Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:54389

Open the full advisory

RHSA-2026:54438

Vulnerability from csaf_redhat - Published: 2026-08-12 21:03 - Updated: 2026-10-30 06:44

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2026-85152.

CVE-2026-85152

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fixed: 17 products Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:54438

Open the full advisory

RHSA-2026:63782

Vulnerability from csaf_redhat - Published: 2026-09-04 15:47 - Updated: 2026-10-30 09:22

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-85152.

CVE-2026-85152

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:63782

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-85152 (GCVE-0-2026-85152)

ALSA-2026:73428 (CVE-2026-19534)

ALSA-2026:73838 (CVE-2026-19534)

ALSA-2026:74085 (CVE-2026-19534)

FKIE_CVE-2026-85152

GHSA-VP8M-P9JH-Q5PM

Impact

Patches

Workarounds

OPENSUSE-SU-2026:22111-1

RHSA-2026:73428

RHSA-2026:54389

RHSA-2026:54438

RHSA-2026:63782

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour