{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs24:\n  * nodejs24-24.18.1-0.2.2.hum1 (aarch64, x86_64)\n  * nodejs24-bin-24.18.1-0.2.2.hum1 (noarch)\n  * nodejs24-devel-24.18.1-0.2.2.hum1 (aarch64, x86_64)\n  * nodejs24-docs-24.18.1-0.2.2.hum1 (noarch)\n  * nodejs24-full-i18n-24.18.1-0.2.2.hum1 (aarch64, x86_64)\n  * nodejs24-libs-24.18.1-0.2.2.hum1 (aarch64, x86_64)\n  * nodejs24-npm-11.16.0-1.24.18.1.0.2.2.hum1 (noarch)\n  * nodejs24-npm-bin-24.18.1-0.2.2.hum1 (noarch)\n  * v8-13.6-devel-13.6.233.17-1.24.18.1.0.2.2.hum1 (aarch64, x86_64)\n  * nodejs24-24.18.1-0.2.2.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:54438",
        "url": "https://access.redhat.com/errata/RHSA-2026:54438"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84933",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84933"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85008",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85008"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84890",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84890"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85014",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85014"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48932",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48932"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54438.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-10T00:05:20+00:00",
      "generator": {
        "date": "2026-09-10T00:05:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:54438",
      "initial_release_date": "2026-08-12T21:03:47+00:00",
      "revision_history": [
        {
          "date": "2026-08-12T21:03:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-07T15:40:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T00:05:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@aarch64",
                "product": {
                  "name": "nodejs24-main@aarch64",
                  "product_id": "nodejs24-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.2.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@src",
                "product": {
                  "name": "nodejs24-main@src",
                  "product_id": "nodejs24-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.2.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@x86_64",
                "product": {
                  "name": "nodejs24-main@x86_64",
                  "product_id": "nodejs24-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.2.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@noarch",
                "product": {
                  "name": "nodejs24-main@noarch",
                  "product_id": "nodejs24-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-bin@24.18.1-0.2.2.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@aarch64"
        },
        "product_reference": "nodejs24-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@noarch"
        },
        "product_reference": "nodejs24-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@src"
        },
        "product_reference": "nodejs24-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@x86_64"
        },
        "product_reference": "nodejs24-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18149",
      "cwe": {
        "id": "CWE-911",
        "name": "Improper Update of Reference Count"
      },
      "discovery_date": "2026-09-04T17:34:19.339068+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528802"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici\u0027s retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service due to orphaned response body in retry handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker-controlled server can trigger a denial of service in applications using undici\u0027s retry handler. This vulnerability allows for resource exhaustion by leaving response bodies orphaned, which can lead to a degradation of service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528802",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528802"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"
        }
      ],
      "release_date": "2026-09-04T17:21:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing undici should implement an independent request deadline and ensure the response body is explicitly destroyed upon expiration. The bodyTimeout mechanism alone is insufficient to prevent resource exhaustion in this scenario.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service due to orphaned response body in retry handler"
    },
    {
      "cve": "CVE-2026-84890",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-09-04T17:23:53.949898+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528772"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a \u0027compression bomb,\u0027 which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded decompression of compressed responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The undici library, used in some Red Hat products, is vulnerable to a denial of service. This occurs when processing untrusted compressed HTTP responses, which can lead to unbounded memory consumption and application crashes. The Moderate severity is due to the requirement of a malicious or faulty upstream server to deliver a specially crafted \u0027compression bomb\u0027 payload.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84890"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528772",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528772"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84890",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84890"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"
        }
      ],
      "release_date": "2026-09-04T17:04:28.261000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded decompression of compressed responses"
    },
    {
      "cve": "CVE-2026-84933",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-09-04T17:10:59.058130+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The software\u0027s caching mechanism, when operating in shared cache mode, improperly stores responses that include \u0027Set-Cookie\u0027 headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"
        }
      ],
      "release_date": "2026-09-04T16:59:08.807000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching"
    },
    {
      "cve": "CVE-2026-85008",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-04T16:55:29.468757+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client\u0027s application state is not updated as expected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85008"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85008",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85008"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"
        }
      ],
      "release_date": "2026-09-04T16:42:40.780000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses"
    },
    {
      "cve": "CVE-2026-85014",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "discovery_date": "2026-09-04T16:41:09.987760+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528712"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici\u0027s experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via WebSocketStream unclean close",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in the `undici` library\u0027s experimental `WebSocketStream` client can lead to a denial of service. An untrusted remote server can crash a vulnerable Node.js client application by abruptly closing a TCP connection without a WebSocket handshake. This affects the availability of applications utilizing `undici` in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85014"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528712",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528712"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85014",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85014"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"
        }
      ],
      "release_date": "2026-09-04T16:30:07.996000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via WebSocketStream unclean close"
    },
    {
      "cve": "CVE-2026-85152",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-04T16:41:35.623977+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528717"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528717",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528717"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
        }
      ],
      "release_date": "2026-09-04T16:36:28.085000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T21:03:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54438"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation"
    }
  ]
}