RHSA-2026:63782

Vulnerability from csaf_redhat - Published: 2026-09-04 15:47 - Updated: 2026-09-24 17:27
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: grafana12.4: * grafana12.4-12.4.9-0.6.hum1 (aarch64, x86_64) * grafana12.4-12.4.9-0.6.hum1.src (src) Security Fix(es): grafana12.4: * CVE-2026-84292 * CVE-2026-84394
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-140 - Improper Neutralization of Delimiters
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 3 products, the same list as for CVE-2026-84292
Threats
Impact Important
CVE-2026-85024

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-431 - Missing Handler
Affected products
Fixed 3 products, the same list as for CVE-2026-84292
Threats
Impact Moderate
CVE-2026-85152

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 3 products, the same list as for CVE-2026-84292
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:63782 self
https://access.redhat.com/security/cve/CVE-2026-84292 external
https://access.redhat.com/security/cve/CVE-2026-84394 external
https://access.redhat.com/security/updates/classi… external
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-85024 external
https://access.redhat.com/security/cve/CVE-2026-85152 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-84292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527747 external
https://www.cve.org/CVERecord?id=CVE-2026-84292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84292 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-84394 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527756 external
https://www.cve.org/CVERecord?id=CVE-2026-84394 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84394 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-85024 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528707 external
https://www.cve.org/CVERecord?id=CVE-2026-85024 external
https://nvd.nist.gov/vuln/detail/CVE-2026-85024 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-85152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528717 external
https://www.cve.org/CVERecord?id=CVE-2026-85152 external
https://nvd.nist.gov/vuln/detail/CVE-2026-85152 external
https://github.com/nodejs/undici/security/advisor… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.9-0.6.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.9-0.6.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n  * CVE-2026-84292\n  * CVE-2026-84394",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:63782",
        "url": "https://access.redhat.com/errata/RHSA-2026:63782"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85024",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63782.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-24T17:27:22+00:00",
      "generator": {
        "date": "2026-09-24T17:27:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:63782",
      "initial_release_date": "2026-09-04T15:47:11+00:00",
      "revision_history": [
        {
          "date": "2026-09-04T15:47:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T19:16:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T17:27:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.9-0.6.hum1@aarch64",
                "product": {
                  "name": "grafana12.4-0:12.4.9-0.6.hum1@aarch64",
                  "product_id": "grafana12.4-0:12.4.9-0.6.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.9-0.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.9-0.6.hum1@src",
                "product": {
                  "name": "grafana12.4-0:12.4.9-0.6.hum1@src",
                  "product_id": "grafana12.4-0:12.4.9-0.6.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.9-0.6.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.9-0.6.hum1@x86_64",
                "product": {
                  "name": "grafana12.4-0:12.4.9-0.6.hum1@x86_64",
                  "product_id": "grafana12.4-0:12.4.9-0.6.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.9-0.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.9-0.6.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64"
        },
        "product_reference": "grafana12.4-0:12.4.9-0.6.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.9-0.6.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src"
        },
        "product_reference": "grafana12.4-0:12.4.9-0.6.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.9-0.6.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
        },
        "product_reference": "grafana12.4-0:12.4.9-0.6.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84292",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-02T20:21:15.599288+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Applications utilizing the `fast-uri` library in Red Hat environments are susceptible to authority injection if they process untrusted data as the port component of a URI. This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
        }
      ],
      "release_date": "2026-09-02T20:09:51.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-04T15:47:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63782"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
    },
    {
      "cve": "CVE-2026-84394",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-09-02T20:31:21.036047+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate because successful exploitation requires a specific configuration where fast-uri handles security checks but a different client resolves the URL, enabling security policy bypasses without direct code execution. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3 (fixed in 2.4.6, 3.1.7, and 4.1.4).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
        }
      ],
      "release_date": "2026-09-02T20:25:35.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-04T15:47:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63782"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
    },
    {
      "cve": "CVE-2026-85024",
      "cwe": {
        "id": "CWE-431",
        "name": "Missing Handler"
      },
      "discovery_date": "2026-09-04T16:32:04.089014+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw exists in the undici WebSocket client, which is used by Node.js. A remote, unauthenticated attacker can send a specially crafted compressed WebSocket message that, upon decompression, exceeds a size limit and contains a malformed DEFLATE block. This can lead to an unhandled error and terminate the Node.js process, causing a denial of service. The attack is asymmetric, allowing a small on-wire payload to crash the process, and can be repeated upon reconnection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85024",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"
        }
      ],
      "release_date": "2026-09-04T16:20:34.709000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-04T15:47:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63782"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-85152",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-04T16:41:35.623977+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528717"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is present in the undici HTTP client library used by Node.js. When an application composes undici\u0027s Cache or Deduplicate interceptor directly onto a Client or Pool object (rather than onto an Agent), the library\u0027s internal cache and in-flight-request deduplication keys omit the destination origin. As a result, a cached or in-flight response captured for one upstream origin can be returned for a request intended for a different, trusted origin whenever the method, path, and relevant headers match. In the most severe demonstrated scenario, this allowed an attacker-controlled JWT to be accepted by the application as though it had been validated against a legitimate, trusted issuer, without that issuer ever being contacted \u2014 resulting in a full authentication bypass.\nExploitation requires that the affected application attach the Cache or Deduplicate interceptor directly to a Client/Pool \u2014 the default Agent-based dispatch path is not affected, since Agent already carries the origin in its dispatch options \u2014 and that an attacker can influence or collide with the cache/deduplication key for at least one origin the application communicates with.).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528717",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528717"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
        }
      ],
      "release_date": "2026-09-04T16:36:28.085000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-04T15:47:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63782"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.9-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.