Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	4.8	CVE-2026-106074	A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... Executive summary This advisory covers many security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a Brotli decoder flaw the advisory says could lead to remote code execution. The advisory rates the highest severity issue as HIGH and says updated versions are available, with releases on or shortly after October 21, 2026. Users should upgrade to the fixed Node.js versions listed (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include DNS name truncation at NUL bytes, TLS hostname verification bypasses involving non-canonical IPv4 spellings and fullwidth digits, a Brotli decoder out-of-bounds write (CVE-2026-111497) that the advisory says can lead to remote code execution, keep-alive socket response confusion, predictable entropy caches in startup snapshots and SEAs, a ZipFile read after failed header validation, a Permission Model wildcard over-grant, and a Permission Model bypass through fs.realpathSync. Attack preconditions are described per issue, such as a certificate issued by a CA trusted by the client and a platform resolver like glibc for one TLS issue, or malformed Brotli input supplied to node:zlib. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, and the advisory does not state which specific versions are affected for each issue beyond the release lines named. Workarounds are not stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.3	CVE-2026-106073	A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks Executive summary This advisory covers multiple security flaws in Node.js across the 26.x, 24.x, and 22.x release lines, including issues that could let attackers bypass permission controls, spoof TLS certificate identities, or potentially run code through the Brotli decompressor. The advisory rates the highest severity issue as HIGH and says the Node.js project will release fixed versions on or shortly after October 21, 2026. Users should upgrade to the updated Node.js releases listed in the advisory (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include a NUL byte truncation in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, an out-of-bounds write in the bundled Brotli decoder that the advisory says can lead to remote code execution, a keep-alive socket response-injection issue, a crypto entropy cache saved into snapshots, a ZipFile prefix-bytes issue, a wildcard radix lookup over-grant in the Permission Model, and a fs.realpathSync permission bypass. Attack preconditions are described per issue, such as an application resolving attacker-influenced hostnames, a certificate issued by a trusted CA for numeric DNS SANs, or a permission model with restricted --allow-fs-read. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, but the advisory does not state which specific version fixes each individual issue. Workarounds and detection guidance for these issues are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.7	CVE-2026-106072	A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... Executive summary This advisory covers CVE-2026-106072, a flaw in Node.js TLS hostname verification that can let a certificate meant for a DNS name be accepted for certain IP address spellings. The advisory rates the highest severity in this release as HIGH and covers several other Node.js issues in the same security release, but it does not give a severity for CVE-2026-106072 itself, which is listed as medium. The recommended action is to upgrade to the fixed Node.js releases named in the advisory, Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The flaw is improper certificate validation in tls.checkServerIdentity(): non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1 are not treated as IP addresses, so a certificate with only a numeric DNS SAN can authenticate an IP endpoint. Exploitation requires a certificate with a numeric DNS SAN issued by a CA the client trusts, and a platform resolver that accepts these spellings, such as glibc. The advisory says affected versions are Node.js 26.x, 24.x and 22.x, and gives fixed versions as Node.js v22.23.4, v24.22.1 and v26.12.1. No workaround is stated in the advisory, and no detection guidance is stated for this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.6	CVE-2026-106071	A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite, The Node.js Project Node.js	NVD	Oct 23 17:17 UTC
CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... Executive summary This advisory covers a low-severity flaw in the Node.js Permission Model, which is meant to restrict file access for Node.js programs. The flaw affects Node.js 26.x and can let code read files outside a wildcard read rule, such as reading /etc/passwd when only /etc/passwd.* is granted. The advisory rates it LOW and points users to the Node.js 26.x security release, Node.js v26.12.1, which is listed alongside the other fixes. Technical summary The flaw is in Node.js Permission Model filesystem enforcement, where the radix tree lookup for wildcard --allow-fs-read or --allow-fs-write rules stops comparing early when the requested path is shorter than the grant prefix, so the path is treated as a match. The advisory says it requires a wildcard grant sitting directly under the root of the permission tree, for example when it is the only grant for that scope, and that the attacker needs code running under --permission. It affects Node.js 26.x only. The advisory does not state a fixed version specifically for this CVE, though it lists Node.js v26.12.1 as the release for the 26.x line. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite The Node.js Project OpenSSL undici Node.js node c-ares SQLite The Node.js Project Node.js NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.7	CVE-2026-106070	A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite, Brotli	NVD	Oct 23 17:17 UTC
CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... Executive summary This advisory covers a batch of security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a high-severity Brotli decoder memory corruption issue that the advisory says could lead to remote code execution. The Node.js Project recommends updating to the fixed releases it names (v22.23.4, v24.22.1, v26.12.1) on or shortly after October 21, 2026, since end-of-life versions are always affected. Technical summary The advisory describes several vulnerability classes: an out-of-bounds write in the Brotli decoder (CVE-2026-111497, high) triggered by malformed compressed input passed to node:zlib, DNS name truncation at NUL bytes, TLS hostname verification bypasses for non-canonical IPv4 forms, HTTP keep-alive response confusion, entropy cache reuse in snapshots, ZipFile returning wrong bytes after header validation failure (26.x only), and Permission Model bypasses via wildcard matching and fs.realpathSync. Fixed versions are given as v22.23.4, v24.22.1, and v26.12.1. Workarounds are not stated in the advisory, and no CVSS scores or evidence of in-the-wild exploitation are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite Brotli OpenSSL undici Node.js node Node.js c-ares SQLite Brotli NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-106069	A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... Executive summary This advisory covers a Node.js security release addressing many flaws across the 26.x, 24.x, and 22.x release lines, with the CVE-2026-106069 issue being a TLS hostname verification flaw that can validate a server certificate against a different IP address than the one connected to. The advisory states the highest severity fixed in each release line is HIGH, and the vendor recommends upgrading to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1 on or shortly after October 21, 2026. Fixed versions for the specific CVE are as stated in the release notes; end-of-life versions are noted as always affected. Technical summary CVE-2026-106069 is a TLS hostname verification flaw in tls.checkServerIdentity() where a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1, is normalized as octal by WHATWG URL rules while the OS resolver reads it as decimal, so a certificate for another IP may be accepted; the advisory notes this occurs on some platforms such as macOS. It affects Node.js 26.x, 24.x, and 22.x, and the advisory states the fix is in the listed releases v22.23.4, v24.22.1, and v26.12.1. The advisory does not state any workaround for this CVE, and it does not state whether exploitation has occurred in the wild. The advisory does not give a CVSS score for this CVE and does not provide specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105483	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... Executive summary This advisory covers a set of security fixes in Node.js releases for the 26.x, 24.x, and 22.x lines, which the advisory says are scheduled for October 21, 2026. The advisory rates the highest severity issue as HIGH and recommends upgrading to the fixed releases, Node.js v22.23.4, v24.22.1, or v26.12.1, since end-of-life versions are always affected by security releases. Technical summary The fixes cover several classes of flaws: TLS hostname verification bypasses for non-canonical or non-ASCII IPv4 spellings (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), DNS name truncation at NUL bytes (CVE-2026-105482), HTTP keep-alive response confusion (CVE-2026-105481), and Permission Model bypasses via fs.realpathSync and wildcard grants (CVE-2026-106073, CVE-2026-106071). Entropy cache leakage into snapshots and SEAs (CVE-2026-106074) and ZIP prefix byte disclosure (CVE-2026-106070) are also addressed. The advisory does not state workarounds for these issues. Detection guidance is not stated. Dependency updates to c-ares, OpenSSL, SQLite, Undici, and a CA certificate list are also included, with the affected release lines given for each. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105482	A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() Executive summary This Node.js security release covers multiple flaws in the 26.x, 24.x and 22.x release lines, including several rated high severity, such as DNS name truncation, TLS hostname bypasses, and a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution. The advisory recommends updating to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1, which are stated as available on or shortly after October 21, 2026. Commercial support for versions past Maintenance LTS is noted as available through OpenJS partners. Technical summary The advisory describes several vulnerability classes: DNS name truncation at NUL bytes (CVE-2026-105482), TLS hostname verification bypasses for fullwidth-digit and leading-zero or non-canonical IPv4 hosts (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), an out-of-bounds write in the Brotli decoder that the advisory says can lead to a crash, memory disclosure, or remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), HTTP keep-alive response confusion, entropy cache leakage into snapshots and SEAs, ZIP header validation bypass, Permission Model wildcard over-grant, and a Permission Model bypass via fs.realpathSync. Affected versions are given per issue, and the fixed versions are listed as Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory does not state workarounds for any issue, and it does not give CVSS scores or exploitation-in-the-wild status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite eMudhra OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105481	A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request Executive summary This advisory covers a set of security fixes in Node.js release lines 26.x, 24.x, and 22.x, with several issues the advisory rates as high severity. The highest severity issue fixed in each release line is HIGH, and the advisory says End-of-Life versions are always affected when a security release occurs. The vendor recommends upgrading to the patched releases Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The issues include DNS name truncation at a NUL byte in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, a Brotli decoder out-of-bounds write that the advisory says can lead to a crash, memory disclosure, or remote code execution, a keep-alive HTTP socket issue that accepts a response sent before the request, crypto entropy cache reuse in startup snapshots and SEAs, a zlib.ZipFile header validation bypass, and Permission Model filesystem bypasses via wildcard rules and fs.realpathSync. Affected versions are listed per issue, and the fixed versions are Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory also lists dependency updates to c-ares, ca-cert, OpenSSL, SQLite, and Undici. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.5	CVE-2026-87029	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-87029undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-87018	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-87018undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-109932	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109932undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-109924	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109924undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-109869	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109869undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-109841	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109841undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	Critical	9.1	CVE-2026-109829	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109829undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	Critical	9.1	CVE-2026-109383	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 19:17 UTC
CVE-2026-109383undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 19:17 UTC Read the advisory
	High	7.5	CVE-2026-109855	undici is an HTTP client library for Node.js undici, Node.jsundici, Node.js Undici	NVD	Oct 15 09:17 UTC
CVE-2026-109855undici is an HTTP client library for Node.js From the advisory undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects undici Node.js undici Node.js Undici NIST National Vulnerability DatabasePublished Oct 15, 2026 09:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited