Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses undici which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-9679

Summary IBM Maximo Application Suite - Visual Inspection component uses undici which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-9679, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-11525...

nodejs:22 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: nodejs24

Issue Overview: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:...

Important: Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: vitess, renovate, py3-captum, kibana, prism, code-server, pelias-api, node-gyp, actions-runner, saf, haraka, npm, gemini-cli...

@0xwork/connect (>=0.1.0, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +507 more potentially affected by CVE-2026-11525 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.4.23-zh, =0.2.0, =0.13.4 and more Source cves:...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2107 more potentially affected by CVE-2026-11525 via undici (>=6.0.0, <=6.26.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-11525 Source advisory: OSV:GHSA-G8M3-5G58-FQ7M...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +727 more potentially affected by CVE-2026-11525 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-11525 Source advisory: OSV:GHSA-G8M3-5G58-FQ7M...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2107 more potentially affected by CVE-2026-11525 via undici (>=6.0.0, <=6.26.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-11525 Source advisory: SNYK:JS-UNDICI-17372758...

@0xwork/connect (>=0.1.0, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +507 more potentially affected by CVE-2026-11525 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.4.23-zh, =0.2.0, =0.13.4 and more Source cves:...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +727 more potentially affected by CVE-2026-11525 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-11525 Source advisory: SNYK:JS-UNDICI-17372758...

UBUNTU-CVE-2026-11525

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example,...

CVE-2026-11525

creationtimestamp| type| source ---|---|--- 2026-06-17 17:34:09+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3moitvr3dbc2g 2026-06-18 15:59:06+00:00| seen| https://bsky.app/profile/nodeland.dev/post/3mol72ndrtt2r 2026-06-23 12:01:44+00:00| seen|...

CVE-2026-11525

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example,...