56 matches found
CVE-2026-15656
CVE-2026-15656 affects IBM Maximo Application Suite (MAS) 9.2, 9.1, and 9.0. The issue is that authorization tokens and session cookies are not marked with the Secure attribute, allowing cookies to be exposed if a user visits an http link or a site containing such a link. As described in the conn...
CVE-2026-18531 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...
NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.0...
Linux Distros Unpatched Vulnerability : CVE-2026-16728
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume ...
UBUNTU-CVE-2026-16729
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
ROOT-APP-NPM-CVE-2026-1527 CVE-2026-1527 in @rootio/undici - Patched by Root
Root has patched CVE-2026-1527 in the @rootio/undici package for Root:npm. Multiple fixed versions available...
EUVD-2026-37769
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse...
CVE-2026-9697
A flaw was found in undici. When undici's ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier URI, it silently ignores Transport Layer Security TLS options, such as custom Certificate Authorities CAs. This allows a remote attacker to perform a Man-in-the-Middle MITM attack,...
Origin Validation Error
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error in the Socks5ProxyAgent. An attacker can intercept or redirect sensitive data, including credentials and request payloads, to...
CVE-2026-9679
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a...
UBUNTU-CVE-2026-12151
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size...
CVE-2026-9679
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a...
TencentOS Server 4: nodejs20 (TSSA-2026:0186)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0186 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
Node.js Module Undici 6.x < 6.24.0 / 7.x < 7.24.0 DoS
The nodejs module Undici detected on the host is version 6.x prior to 6.24.0 or version 7.x prior to 7.24.0. It is, therefore, affected by a denial of service vulnerability : - A flaw exists in the WebSocket client due to an integer overflow when processing frames with extremely large 64-bit leng...
RLSA-2026:7080 Important: nodejs22 security update
Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...
SUSE CVE-2026-1528
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0...
SUSE CVE-2026-2229
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the servermaxwindowbits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. ...
nodejs:24 security update
An update is available for nodejs, module.nodejs-packaging, nodejs-packaging, module.nodejs, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...