ROOT-APP-NPM-CVE-2026-1526 CVE-2026-1526 in undici - Patched by Root

Root has patched CVE-2026-1526 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-1528 CVE-2026-1528 in undici - Patched by Root

Root has patched CVE-2026-1528 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-2229 CVE-2026-2229 in undici - Patched by Root

Root has patched CVE-2026-2229 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-12151 CVE-2026-12151 in undici - Patched by Root

Root has patched CVE-2026-12151 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in undici - Patched by Root

Root has patched CVE-2026-6734 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9697 CVE-2026-9697 in undici - Patched by Root

Root has patched CVE-2026-9697 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in undici - Patched by Root

Root has patched CVE-2026-9679 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-13697 CVE-2026-13697 in undici - Patched by Root

Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9678 CVE-2026-9678 in undici - Patched by Root

Root has patched CVE-2026-9678 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-30260 CVE-2024-30260 in undici - Patched by Root

Root has patched CVE-2024-30260 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-30261 CVE-2024-30261 in undici - Patched by Root

Root has patched CVE-2024-30261 in the undici package for Root:npm. Multiple fixed versions available...

CVE-2026-73410

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410

Budibase versions prior to 3.40.0 have a DNS-rebinding SSRF flaw in the REST datasource integration. The guard fetchWithBlacklist pins a validated IP via a Node http(s).Agent, but rest.ts routes requests through undici's fetch, which silently ignores the agent option and uses its own dispatcher t...

CVE-2026-73410

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

EUVD-2026-60380

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

Important: nodejs24

Issue Overview: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant...

MiracleLinux 9 : nodejs:22 (AXSA:2026-1513:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1513:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CLSA-2026-1786370674 TuxCare security update for undici (2 CVEs)

TuxCare rebuilt undici to address 2 CVEs. Fixed in 5.29.0-tuxcare.5...

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion,...