DirtySlide

DirtySlide Unprivileged → root macOS LPE. An 8-byte OOB read/write into kernel memory adjacent to a dyld shared-cache page, from a missing in-page bounds check in the v5 slide walk vmsharedregionslidepagev5, reachable via syscall 536. Patched in macOS 26.5.2 25F84, xnu-12377.121.10. Vulnerable...

Important: nodejs24

Issue Overview: Node js security advisory: Permission Model filesystem over-grant via wildcard radix lookup CVE-2026-106071 undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached...

undici: undici: Cache poisoning via intermediate redirect hops

A flaw was found in undici. When handling HTTP redirects with a shared cache enabled, the client inspects only the final redirect destination and fails to account for intermediate hops. A remote attacker who controls a redirect target can exploit this vulnerability to poison the shared cache, whi...

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to pois...

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to pois...

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to pois...

CVE-2026-126073: rails: Action Pack is a framework for handling and responding to web requests

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...

CVE-2026-116592

A flaw was found in undici. When handling HTTP redirects with a shared cache enabled, the client inspects only the final redirect destination and fails to account for intermediate hops. A remote attacker who controls a redirect target can exploit this vulnerability to poison the shared cache, whi...

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to pois...

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to pois...

CVE-2026-116630

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...

UBUNTU-CVE-2026-116630

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...

CVE-2026-116630

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...

CVE-2026-116592

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which...

Linux Distros Unpatched Vulnerability : CVE-2026-116592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors...

Linux Distros Unpatched Vulnerability : CVE-2026-116630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache...

Authorization Bypass Through User-Controlled Key

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the CacheHandler.onResponseStart function in the cache handler. With an originless Agent using a shared cache and...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error via the cache-handler.js redirect-hop inspection logic when an originless Agent composes the redirect and shared cache interceptors as...

DEBIAN-CVE-2026-116630

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...

AZL-113236 CVE-2026-116630 affecting package nodejs for versions less than 24.22.3-1

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...