Most recent entries from all

ALSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update

Affected: AlmaLinux:10: nodejs24, AlmaLinux:10: nodejs24-devel, AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-full-i18n, AlmaLinux:10: nodejs24-libs, AlmaLinux:10: nodejs24-npm

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()…

certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1094

Withdrawn: CLEANSTART-2026-ID18571 — brace-expansion through 5

Withdrawn by the publisher.

Affected: CleanStart: npm

Multiple security vulnerabilities affect the npm package. brace-expansion through 5. See references for individual vulnerability details.

EUVD-2026-328307

fkie_cve-2026-6733

This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

GHSA-35p6-xmwp-9g52 — undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Affected: npm: undici

## Impact

Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.

This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.

## Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

## Workarounds

Disable keep-alive connection reuse by setting `keepAliveTimeout: 0` on the Client or Pool.

openSUSE-SU-2026:11121-1 — corepack24-24.17.0-1.1 on GA media

corepack24-24.17.0-1.1 on GA media

RHSA-2026:38009 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

RLSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update

Affected: Rocky Linux:10: nodejs24

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933…

SUSE-SU-2026:22368-1 — Security update for nodejs22

Security update for nodejs22

UBUNTU-CVE-2026-6733

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

WID-SEC-W-2026-2618 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.