kritisch
CVE-2026-84961
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch).
Beschreibung
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | nodejs24, nodejs24-devel, nodejs24-docs und 3 weitere | 1:24.21.0-1.el10_2 und 1 weitere |
| alma 8 | nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs und 7 weitere | 1:24.21.0-1.module_el8.10.0+4292+21afb960 und 4 weitere |
| alma 9 | nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs und 7 weitere | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 und 4 weitere |
| amazon linux 2023 | nodejs24, nodejs24-debuginfo, nodejs24-debugsource und 7 weitere | 1:24.21.0-1.amzn2023.0.1 und 2 weitere |
| chainguard | code-server, commercial-gitlab-rails-ee-19.1, commercial-gitlab-rails-ee-19.2 und 11 weitere | 4.139.1-r2 und 10 weitere |
| debian 12 | node-undici | kein Fix angegeben |
| debian 13 | node-undici | kein Fix angegeben |
| debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 |
| echo | node-undici | kein Fix angegeben |
| echo npm::Echo OSV | undici | 7.29.1 |
| minimos | ghost, homepage, kibana-9.4 und 9 weitere | 6.67.0-r0 und 11 weitere |
| npm::GitHub Security Advisory npm | undici | 7.29.1, 8.10.2 |
Alle 201 Einträge aus 30 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| alma 8 | nodejs:24::nodejs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-devel | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-docs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-libs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 |
| alma 8 | nodejs:24::nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960 |
| alma 9 | nodejs:24::nodejs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-devel | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-docs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-libs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 |
| alma 9 | nodejs:24::nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2 |
| amazon linux 2023 | nodejs24 | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debuginfo | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debugsource | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-devel | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-docs | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-full-i18n | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs-debuginfo | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 |
| amazon linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 |
| chainguard | code-server | 4.139.1-r2 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| chainguard | homepage | 2.4.0-r1 |
| chainguard | kibana-9.2 | 9.2.8-r23 |
| chainguard | lerna | 10.0.1-r11 |
| chainguard | node-gyp | 13.0.2-r1 |
| chainguard | prism | 5.16.0-r14 |
| debian 12 | node-undici | kein Fix angegeben |
| debian 13 | node-undici | kein Fix angegeben |
| debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 |
| echo | node-undici | kein Fix angegeben |
| echo npm::Echo OSV | undici | 7.29.1 |
| minimos | ghost | 6.67.0-r0 |
| minimos | homepage | 2.5.0-r0 |
| minimos | kibana-9.4 | 9.4.8-r0 |
| minimos | kibana-9.5 | 9.5.5-r0 |
| minimos | langfuse-4 | 4.32.0-r0 |
| minimos | mcp-context7 | 4.1.3-r0 |
| minimos | mcp-mongodb | 3.1.0-r0 |
| minimos | n8n | 2.41.3-r0 |
| minimos | node-gyp | 13.1.0-r0 |
| minimos | openclaw | 2026.9.2-r0 |
| minimos | pi-cli | 0.86.0-r0 |
| minimos | trigger-dev | 4.5.11-r1 |
| npm::GitHub Security Advisory npm | undici | 7.29.1, 8.10.2 |
| Oracle Linux 8 | nodejs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-devel | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-docs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-full-i18n | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-libs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 9 | nodejs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-devel | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | nodejs-packaging | 2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa |
| rapidfort alma 10 | nodejs | kein Fix angegeben |
| rapidfort alma 10 | nodejs-devel | kein Fix angegeben |
| rapidfort alma 10 | nodejs-docs | kein Fix angegeben |
| rapidfort alma 10 | nodejs-full-i18n | kein Fix angegeben |
| rapidfort alma 10 | nodejs-libs | kein Fix angegeben |
| rapidfort alma 10 | nodejs-npm | kein Fix angegeben |
| rapidfort alma 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| rapidfort alma 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort alma 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort amazon linux 2023 | nodejs | kein Fix angegeben |
| rapidfort amazon linux 2023 | nodejs20 | kein Fix angegeben |
| rapidfort amazon linux 2023 | nodejs24 | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-devel | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-docs | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-full-i18n | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-libs | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 |
| rapidfort debian 12 | node-undici | 0:8.10.2+dfsg+~cs3.2.2-1 |
| rapidfort debian 13 | node-undici | 0:8.10.2+dfsg+~cs3.2.2-1 |
| rapidfort Oracle Linux 10 | nodejs | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs-devel | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs-docs | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs-full-i18n | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs-libs | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs-npm | kein Fix angegeben |
| rapidfort Oracle Linux 10 | nodejs24 | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-devel | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-docs | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-full-i18n | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-libs | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 |
| rapidfort Oracle Linux 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-devel | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 10 | nodejs | kein Fix angegeben |
| rapidfort Red Hat 10 | nodejs-devel | kein Fix angegeben |
| rapidfort Red Hat 10 | nodejs-docs | kein Fix angegeben |
| rapidfort Red Hat 10 | nodejs-full-i18n | kein Fix angegeben |
| rapidfort Red Hat 10 | nodejs-libs | kein Fix angegeben |
| rapidfort Red Hat 10 | nodejs-npm | kein Fix angegeben |
| rapidfort Red Hat 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort Red Hat 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort rocky 10 | nodejs | kein Fix angegeben |
| rapidfort rocky 10 | nodejs-full-i18n | kein Fix angegeben |
| rapidfort rocky 10 | nodejs-libs | kein Fix angegeben |
| rapidfort rocky 9 | nodejs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+40281+14cc6568 |
| rapidfort rocky 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| Red Hat | nodejs:22::nodejs | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-devel | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-docs | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-full-i18n | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-libs | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-nodemon | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-packaging | kein Fix angegeben |
| Red Hat | nodejs:22::nodejs-packaging-bundler | kein Fix angegeben |
| Red Hat | nodejs:22::npm | kein Fix angegeben |
| Red Hat | nodejs:22::v8-12.4-devel | kein Fix angegeben |
| Red Hat | nodejs:22::v8-13.6-devel | kein Fix angegeben |
| Red Hat | nodejs:26::nodejs | kein Fix angegeben |
| Red Hat | nodejs:26::nodejs-docs | kein Fix angegeben |
| Red Hat | nodejs:26::nodejs-full-i18n | kein Fix angegeben |
| Red Hat | nodejs:26::nodejs-libs | kein Fix angegeben |
| Red Hat | nodejs:26::npm | kein Fix angegeben |
| rocky 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| rocky 8 | nodejs:24::nodejs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-devel | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-docs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-libs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-nodemon | 3.1.14-2.module+el8.10.0+40278+50b003a3 |
| rocky 8 | nodejs:24::nodejs-packaging | 2021.06-6.module+el8.10.0+40171+8fa9c325 |
| rocky 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+40048+6d99f608 |
| rocky 8 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+40368+1252295d |
| rocky 9 | nodejs:24::nodejs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-devel | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-docs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-libs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-nodemon | 3.1.14-3.module+el9.8.0+40281+14cc6568 |
| rocky 9 | nodejs:24::nodejs-packaging | 2021.06-6.module+el9.8.0+40164+8921ab53 |
| rocky 9 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module+el9.7.0+40165+d075e3f2 |
| rocky 9 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+40367+53e75021 |
| wolfi | code-server | 4.139.1-r2 |
| wolfi | lerna | 10.0.1-r11 |
| wolfi | node-gyp | 13.0.2-r1 |
| wolfi | prism | 5.16.0-r14 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:73838
- https://access.redhat.com/security/cve/CVE-2026-84961
- https://advisory.echohq.com/cve/CVE-2026-84961
- https://bugzilla.redhat.com/2528717
- https://bugzilla.redhat.com/2528735
- https://bugzilla.redhat.com/2528759
- https://bugzilla.redhat.com/show_bug.cgi?id=2528717
- https://bugzilla.redhat.com/show_bug.cgi?id=2528735
Alle 26 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2528759
- https://cna.openjsf.org/security-advisories.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84961
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85152
- https://errata.almalinux.org/9/ALSA-2026-73838.html
- https://errata.rockylinux.org/RLSA-2026:73838
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390
- https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3
- https://linux.oracle.com/cve/CVE-2026-84961.html
- https://linux.oracle.com/errata/ELSA-2026-74085.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-84961
- https://www.cve.org/CVERecord?id=CVE-2026-84961