{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs26:\n  * nodejs26-26.8.2-0.1.hum1 (aarch64, x86_64)\n  * nodejs26-bin-26.8.2-0.1.hum1 (noarch)\n  * nodejs26-devel-26.8.2-0.1.hum1 (aarch64, x86_64)\n  * nodejs26-docs-26.8.2-0.1.hum1 (noarch)\n  * nodejs26-full-i18n-26.8.2-0.1.hum1 (aarch64, x86_64)\n  * nodejs26-libs-26.8.2-0.1.hum1 (aarch64, x86_64)\n  * nodejs26-npm-11.19.1-1.26.8.2.0.1.hum1 (noarch)\n  * nodejs26-npm-bin-26.8.2-0.1.hum1 (noarch)\n  * v8-14.6-devel-14.6.202.34-1.26.8.2.0.1.hum1 (aarch64, x86_64)\n  * nodejs26-26.8.2-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66605",
        "url": "https://access.redhat.com/errata/RHSA-2026:66605"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84961",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19534",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18540",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18540"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85024",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66605.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-24T16:27:57+00:00",
      "generator": {
        "date": "2026-09-24T16:27:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:66605",
      "initial_release_date": "2026-09-11T15:13:07+00:00",
      "revision_history": [
        {
          "date": "2026-09-11T15:13:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-11T15:39:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T16:27:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-0:26.8.2-0.1.hum1@aarch64",
                "product": {
                  "name": "nodejs26-0:26.8.2-0.1.hum1@aarch64",
                  "product_id": "nodejs26-0:26.8.2-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.8.2-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-0:26.8.2-0.1.hum1@src",
                "product": {
                  "name": "nodejs26-0:26.8.2-0.1.hum1@src",
                  "product_id": "nodejs26-0:26.8.2-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.8.2-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-0:26.8.2-0.1.hum1@x86_64",
                "product": {
                  "name": "nodejs26-0:26.8.2-0.1.hum1@x86_64",
                  "product_id": "nodejs26-0:26.8.2-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.8.2-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-bin-0:26.8.2-0.1.hum1@noarch",
                "product": {
                  "name": "nodejs26-bin-0:26.8.2-0.1.hum1@noarch",
                  "product_id": "nodejs26-bin-0:26.8.2-0.1.hum1@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.8.2-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-0:26.8.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64"
        },
        "product_reference": "nodejs26-0:26.8.2-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-0:26.8.2-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src"
        },
        "product_reference": "nodejs26-0:26.8.2-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-0:26.8.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64"
        },
        "product_reference": "nodejs26-0:26.8.2-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-0:26.8.2-0.1.hum1@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
        },
        "product_reference": "nodejs26-bin-0:26.8.2-0.1.hum1@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18540",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-04T17:26:35.687862+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: HTTP response splitting via retry interceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in the undici HTTP client\u0027s retry interceptor can lead to HTTP response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards responses without proper framing normalization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18540",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
        }
      ],
      "release_date": "2026-09-04T17:15:50.619000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T15:13:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66605"
        },
        {
          "category": "workaround",
          "details": "Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0 on the retry interceptor configuration. Alternatively, remove or recalculate the Content-Length header before forwarding a response body assembled by undici to downstream HTTP/1.1 peers.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "undici: undici: HTTP response splitting via retry interceptor"
    },
    {
      "cve": "CVE-2026-19534",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-09-04T17:21:01.599799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528759"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528759",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
        }
      ],
      "release_date": "2026-09-04T17:10:05.081000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T15:13:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66605"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
    },
    {
      "cve": "CVE-2026-84961",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-04T16:52:40.440125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici\u0027s BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw only affects applications that construct an undici BalancedPool with a function-valued connect or tls option \u2014 for example, a custom checkServerIdentity callback or connector used for certificate pinning across multiple upstreams. Client, Pool, Agent, and RoundRobinPool destructure these options before the internal JSON-based clone and are not affected. An attacker able to present, on the network path, a TLS endpoint whose certificate the application\u0027s custom validator was written to reject \u2014 but which still satisfies Node.js\u0027s default hostname and chain checks \u2014 can have that certificate silently accepted when the connection goes through BalancedPool, enabling a man-in-the-middle attack against affected connections.\nThis affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84961",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"
        }
      ],
      "release_date": "2026-09-04T16:47:55.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T15:13:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66605"
        },
        {
          "category": "workaround",
          "details": "Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options"
    },
    {
      "cve": "CVE-2026-85024",
      "cwe": {
        "id": "CWE-431",
        "name": "Missing Handler"
      },
      "discovery_date": "2026-09-04T16:32:04.089014+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw exists in the undici WebSocket client, which is used by Node.js. A remote, unauthenticated attacker can send a specially crafted compressed WebSocket message that, upon decompression, exceeds a size limit and contains a malformed DEFLATE block. This can lead to an unhandled error and terminate the Node.js process, causing a denial of service. The attack is asymmetric, allowing a small on-wire payload to crash the process, and can be repeated upon reconnection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85024",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"
        }
      ],
      "release_date": "2026-09-04T16:20:34.709000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T15:13:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66605"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-0:26.8.2-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-0:26.8.2-0.1.hum1@noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression"
    }
  ]
}