RHSA-2026:87703
Vulnerability from csaf_redhat - Published: 2026-10-22 03:44 - Updated: 2026-11-04 15:48Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
nodejs26:
* nodejs26-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)
* nodejs26-bin-26.12.1-0.1.hum1 (noarch)
* nodejs26-devel-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)
* nodejs26-docs-26.12.1-0.1.hum1 (noarch)
* nodejs26-full-i18n-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)
* nodejs26-libs-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)
* nodejs26-npm-11.20.0-1.26.12.1.0.1.hum1 (noarch)
* nodejs26-npm-bin-26.12.1-0.1.hum1 (noarch)
* v8-14.6-devel-14.6.202.34-1.26.12.1.0.1.hum1 (aarch64, s390x, x86_64)
* nodejs26-26.12.1-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.
7.5 (High)
Affected products
Fixed
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
Known not affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64 | — | ||
| Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x | — | ||
| Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64 | — |
Threats
Impact
Important
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.
7.4 (High)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Important
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.
7.4 (High)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Important
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.
7.4 (High)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Important
A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.
7.5 (High)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Important
A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.
5.9 (Medium)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Moderate
A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.
5.9 (Medium)
Affected products
Fixed
25 products, the same list as for
CVE-2026-87018
Known not affected
3 products, the same list as for
CVE-2026-87018
Threats
Impact
Moderate
References
51 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nnodejs26:\n * nodejs26-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)\n * nodejs26-bin-26.12.1-0.1.hum1 (noarch)\n * nodejs26-devel-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)\n * nodejs26-docs-26.12.1-0.1.hum1 (noarch)\n * nodejs26-full-i18n-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)\n * nodejs26-libs-26.12.1-0.1.hum1 (aarch64, s390x, x86_64)\n * nodejs26-npm-11.20.0-1.26.12.1.0.1.hum1 (noarch)\n * nodejs26-npm-bin-26.12.1-0.1.hum1 (noarch)\n * v8-14.6-devel-14.6.202.34-1.26.12.1.0.1.hum1 (aarch64, s390x, x86_64)\n * nodejs26-26.12.1-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:87703",
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87018",
"url": "https://access.redhat.com/security/cve/CVE-2026-87018"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109932",
"url": "https://access.redhat.com/security/cve/CVE-2026-109932"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109924",
"url": "https://access.redhat.com/security/cve/CVE-2026-109924"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109383",
"url": "https://access.redhat.com/security/cve/CVE-2026-109383"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109869",
"url": "https://access.redhat.com/security/cve/CVE-2026-109869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-105482",
"url": "https://access.redhat.com/security/cve/CVE-2026-105482"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-105483",
"url": "https://access.redhat.com/security/cve/CVE-2026-105483"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87703.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-11-04T15:48:34+00:00",
"generator": {
"date": "2026-11-04T15:48:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:87703",
"initial_release_date": "2026-10-22T03:44:16+00:00",
"revision_history": [
{
"date": "2026-10-22T03:44:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-28T10:21:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-04T15:48:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs26-1:26.12.1-0.1.hum1@aarch64",
"product": {
"name": "nodejs26-1:26.12.1-0.1.hum1@aarch64",
"product_id": "nodejs26-1:26.12.1-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26@26.12.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"product": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"product_id": "nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"product": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"product_id": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"product": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"product_id": "nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"product": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"product_id": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.12.1.0.1.hum1?arch=aarch64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs26-1:26.12.1-0.1.hum1@s390x",
"product": {
"name": "nodejs26-1:26.12.1-0.1.hum1@s390x",
"product_id": "nodejs26-1:26.12.1-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26@26.12.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"product": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"product_id": "nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"product": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"product_id": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"product": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"product_id": "nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"product": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"product_id": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.12.1.0.1.hum1?arch=s390x\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs26-1:26.12.1-0.1.hum1@src",
"product": {
"name": "nodejs26-1:26.12.1-0.1.hum1@src",
"product_id": "nodejs26-1:26.12.1-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26@26.12.1-0.1.hum1?arch=src\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs26-1:26.12.1-0.1.hum1@x86_64",
"product": {
"name": "nodejs26-1:26.12.1-0.1.hum1@x86_64",
"product_id": "nodejs26-1:26.12.1-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26@26.12.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"product": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"product_id": "nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"product": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"product_id": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"product": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"product_id": "nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64",
"product": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64",
"product_id": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.12.1.0.1.hum1?arch=x86_64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-docs@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-docs@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-docs@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.12.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.12.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.12.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.12.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64"
},
"product_reference": "nodejs26-1:26.12.1-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x"
},
"product_reference": "nodejs26-1:26.12.1-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-1:26.12.1-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src"
},
"product_reference": "nodejs26-1:26.12.1-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64"
},
"product_reference": "nodejs26-1:26.12.1-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64"
},
"product_reference": "nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x"
},
"product_reference": "nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-devel-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64"
},
"product_reference": "nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64"
},
"product_reference": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x"
},
"product_reference": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64"
},
"product_reference": "nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64"
},
"product_reference": "nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x"
},
"product_reference": "nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-libs-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64"
},
"product_reference": "nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64"
},
"product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x"
},
"product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
},
"product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-87018",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-15T18:45:26.683580+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553677"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87018"
},
{
"category": "external",
"summary": "RHBZ#2553677",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87018"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"
}
],
"release_date": "2026-10-15T18:38:25.613000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate"
},
{
"acknowledgments": [
{
"names": [
"Hasan Flayyih Abdullah"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-105482",
"cwe": {
"id": "CWE-158",
"name": "Improper Neutralization of Null Byte or NUL Character"
},
"discovery_date": "2026-10-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559875"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-105482"
},
{
"category": "external",
"summary": "RHBZ#2559875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559875"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-105482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-105482"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/release/v22.23.4",
"url": "https://nodejs.org/en/blog/release/v22.23.4"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
},
{
"category": "workaround",
"details": "To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character"
},
{
"acknowledgments": [
{
"names": [
"Hasan Flayyih Abdullah"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-105483",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-10-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a hostname that contains fullwidth Unicode digits which normalize to an IPv4 address, together with a certificate that satisfies the incorrect matching behavior. Attack Complexity is High because the attacker must influence the host string used for the connection (for example a user-supplied URL) and present a suitable certificate, typically with a privileged network position relative to that connection. Confidentiality and Integrity are High because a successful bypass enables server impersonation and exposure or alteration of TLS application data; Availability is not affected. This flaw affects Node.js 24.x and 26.x lines and does not affect the 22.x line per the upstream advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-105483"
},
{
"category": "external",
"summary": "RHBZ#2559870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-105483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-105483"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/release/v24.22.1",
"url": "https://nodejs.org/en/blog/release/v24.22.1"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
},
{
"category": "workaround",
"details": "To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to normalize hostnames and IP representations to standard ASCII before passing destination strings to TLS client calls such as tls.connect, https.request, or fetch: upgrade to Node.js v24.22.1, v26.12.1 (or the fixed Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which fix IP normalization regression in TLS hostname validation to ensure fullwidth digit hostnames are recognized as IP addresses, closing all 2 injection vectors (fullwidth Unicode digit IPv4 connection strings, DNS SAN matching on numeric hostnames). Until patched, this is only a concern on Node.js applications running on 24.x and 26.x runtimes establishing TLS client connections \u2014 Node.js 22.x deployments are unaffected \u2014 so Do not pass untrusted hostnames or URLs that may contain non-ASCII or fullwidth digits into TLS clients, and restrict outbound TLS connections to trusted destinations. As a compensating measure, Restrict outbound requests to a validated destination allowlist to prevent arbitrary attacker-controlled host strings from reaching Node.js TLS clients and Segment services initiating TLS client connections from untrusted networks to prevent attackers from intercepting or impersonating connections. These controls limit blast radius and contain exploitation, but they do not fix the underlying TLS IP hostname normalization defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames"
},
{
"cve": "CVE-2026-109383",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-15T18:45:43.553803+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Certificate validation bypass via dropped TLS options in Agent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109383"
},
{
"category": "external",
"summary": "RHBZ#2553678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/f75eac00ac17",
"url": "https://github.com/nodejs/undici/commit/f75eac00ac17"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
}
],
"release_date": "2026-10-15T18:34:01.468000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent"
},
{
"cve": "CVE-2026-109869",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T18:31:39.700754+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553656"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109869"
},
{
"category": "external",
"summary": "RHBZ#2553656",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/b5084c7dc239",
"url": "https://github.com/nodejs/undici/commit/b5084c7dc239"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
}
],
"release_date": "2026-10-15T18:08:31.243000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings"
},
{
"cve": "CVE-2026-109924",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-15T18:34:33.100871+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553663"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via memory exhaustion in EventSource client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate rather than Important because exploitation requires a Node.js client application to actively connect to an untrusted or compromised Server-Sent Events endpoint. In standard Red Hat product deployments, applications typically consume trusted, internal network services rather than arbitrary external feeds. Additionally, the impact is strictly confined to process termination from resource exhaustion, with no compromise to data confidentiality or system integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109924"
},
{
"category": "external",
"summary": "RHBZ#2553663",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553663"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/789ef26461c",
"url": "https://github.com/nodejs/undici/commit/789ef26461c"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"
}
],
"release_date": "2026-10-15T18:16:48.452000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via memory exhaustion in EventSource client"
},
{
"cve": "CVE-2026-109932",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-15T19:02:19.103535+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client\u0027s automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an affected client application to initiate an outbound WebSocket connection to a malicious or compromised remote endpoint, rather than being exposed on inbound service ports. In typical Red Hat environments, Node.js workloads communicate with trusted internal services, limiting the likelihood of interacting with hostile endpoints. Additionally, the blast radius is confined to process crashes resulting from memory exhaustion, with no compromise of data confidentiality or integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"known_not_affected": [
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109932"
},
{
"category": "external",
"summary": "RHBZ#2553687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"
}
],
"release_date": "2026-10-15T18:44:22.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T03:44:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87703"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@src",
"Red Hat Hardened Images:nodejs26-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-devel-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@aarch64",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@s390x",
"Red Hat Hardened Images:nodejs26-libs-1:26.12.1-0.1.hum1@x86_64",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x",
"Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.