critique
CVE-2026-84961
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (élevée), AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée).
Description
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 10 | nodejs24, nodejs24-devel, nodejs24-docs et 3 autres | 1:24.21.0-1.el10_2 et 1 autres |
| alma 8 | nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs et 7 autres | 1:24.21.0-1.module_el8.10.0+4292+21afb960 et 4 autres |
| alma 9 | nodejs:24::nodejs, nodejs:24::nodejs-devel, nodejs:24::nodejs-docs et 7 autres | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 et 4 autres |
| amazon linux 2023 | nodejs24, nodejs24-debuginfo, nodejs24-debugsource et 7 autres | 1:24.21.0-1.amzn2023.0.1 et 2 autres |
| chainguard | code-server, commercial-gitlab-rails-ee-19.1, commercial-gitlab-rails-ee-19.2 et 11 autres | 4.139.1-r2 et 10 autres |
| debian 12 | node-undici | pas de correctif indiqué |
| debian 13 | node-undici | pas de correctif indiqué |
| debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 |
| echo | node-undici | pas de correctif indiqué |
| echo npm::Echo OSV | undici | 7.29.1 |
| minimos | ghost, homepage, kibana-9.4 et 9 autres | 6.67.0-r0 et 11 autres |
| npm::GitHub Security Advisory npm | undici | 7.29.1, 8.10.2 |
Afficher les 201 entrées de 30 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| alma 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| alma 8 | nodejs:24::nodejs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-devel | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-docs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-libs | 1:24.21.0-1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 |
| alma 8 | nodejs:24::nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960 |
| alma 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960 |
| alma 9 | nodejs:24::nodejs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-devel | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-docs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-libs | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 |
| alma 9 | nodejs:24::nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2 |
| alma 9 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2 |
| amazon linux 2023 | nodejs24 | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debuginfo | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debugsource | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-devel | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-docs | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-full-i18n | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs-debuginfo | 1:24.21.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 |
| amazon linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 |
| chainguard | code-server | 4.139.1-r2 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| chainguard | homepage | 2.4.0-r1 |
| chainguard | kibana-9.2 | 9.2.8-r23 |
| chainguard | lerna | 10.0.1-r11 |
| chainguard | node-gyp | 13.0.2-r1 |
| chainguard | prism | 5.16.0-r14 |
| debian 12 | node-undici | pas de correctif indiqué |
| debian 13 | node-undici | pas de correctif indiqué |
| debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 |
| echo | node-undici | pas de correctif indiqué |
| echo npm::Echo OSV | undici | 7.29.1 |
| minimos | ghost | 6.67.0-r0 |
| minimos | homepage | 2.5.0-r0 |
| minimos | kibana-9.4 | 9.4.8-r0 |
| minimos | kibana-9.5 | 9.5.5-r0 |
| minimos | langfuse-4 | 4.32.0-r0 |
| minimos | mcp-context7 | 4.1.3-r0 |
| minimos | mcp-mongodb | 3.1.0-r0 |
| minimos | n8n | 2.41.3-r0 |
| minimos | node-gyp | 13.1.0-r0 |
| minimos | openclaw | 2026.9.2-r0 |
| minimos | pi-cli | 0.86.0-r0 |
| minimos | trigger-dev | 4.5.11-r1 |
| npm::GitHub Security Advisory npm | undici | 7.29.1, 8.10.2 |
| Oracle Linux 8 | nodejs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-devel | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-docs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-full-i18n | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-libs | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c |
| Oracle Linux 9 | nodejs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-devel | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | nodejs-packaging | 2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-6.module+el9.8.0+91009+5d530ccd |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa |
| rapidfort alma 10 | nodejs | pas de correctif indiqué |
| rapidfort alma 10 | nodejs-devel | pas de correctif indiqué |
| rapidfort alma 10 | nodejs-docs | pas de correctif indiqué |
| rapidfort alma 10 | nodejs-full-i18n | pas de correctif indiqué |
| rapidfort alma 10 | nodejs-libs | pas de correctif indiqué |
| rapidfort alma 10 | nodejs-npm | pas de correctif indiqué |
| rapidfort alma 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| rapidfort alma 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort alma 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort alma 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort amazon linux 2023 | nodejs | pas de correctif indiqué |
| rapidfort amazon linux 2023 | nodejs20 | pas de correctif indiqué |
| rapidfort amazon linux 2023 | nodejs24 | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-devel | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-docs | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-full-i18n | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-libs | 1:24.21.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 |
| rapidfort debian 12 | node-undici | 0:8.10.2+dfsg+~cs3.2.2-1 |
| rapidfort debian 13 | node-undici | 0:8.10.2+dfsg+~cs3.2.2-1 |
| rapidfort Oracle Linux 10 | nodejs | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs-devel | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs-docs | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs-full-i18n | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs-libs | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs-npm | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | nodejs24 | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-devel | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-docs | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-full-i18n | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-libs | 1:24.21.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 |
| rapidfort Oracle Linux 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-devel | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 10 | nodejs | pas de correctif indiqué |
| rapidfort Red Hat 10 | nodejs-devel | pas de correctif indiqué |
| rapidfort Red Hat 10 | nodejs-docs | pas de correctif indiqué |
| rapidfort Red Hat 10 | nodejs-full-i18n | pas de correctif indiqué |
| rapidfort Red Hat 10 | nodejs-libs | pas de correctif indiqué |
| rapidfort Red Hat 10 | nodejs-npm | pas de correctif indiqué |
| rapidfort Red Hat 9 | nodejs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-docs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+24924+cd677006 |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d |
| rapidfort Red Hat 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| rapidfort rocky 10 | nodejs | pas de correctif indiqué |
| rapidfort rocky 10 | nodejs-full-i18n | pas de correctif indiqué |
| rapidfort rocky 10 | nodejs-libs | pas de correctif indiqué |
| rapidfort rocky 9 | nodejs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-libs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+40281+14cc6568 |
| rapidfort rocky 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 |
| Red Hat | nodejs:22::nodejs | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-devel | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-docs | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-full-i18n | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-libs | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-nodemon | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-packaging | pas de correctif indiqué |
| Red Hat | nodejs:22::nodejs-packaging-bundler | pas de correctif indiqué |
| Red Hat | nodejs:22::npm | pas de correctif indiqué |
| Red Hat | nodejs:22::v8-12.4-devel | pas de correctif indiqué |
| Red Hat | nodejs:22::v8-13.6-devel | pas de correctif indiqué |
| Red Hat | nodejs:26::nodejs | pas de correctif indiqué |
| Red Hat | nodejs:26::nodejs-docs | pas de correctif indiqué |
| Red Hat | nodejs:26::nodejs-full-i18n | pas de correctif indiqué |
| Red Hat | nodejs:26::nodejs-libs | pas de correctif indiqué |
| Red Hat | nodejs:26::npm | pas de correctif indiqué |
| rocky 10 | nodejs24 | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-devel | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-docs | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-full-i18n | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-libs | 1:24.21.0-1.el10_2 |
| rocky 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 |
| rocky 8 | nodejs:24::nodejs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-devel | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-docs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-libs | 1:24.21.0-1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::nodejs-nodemon | 3.1.14-2.module+el8.10.0+40278+50b003a3 |
| rocky 8 | nodejs:24::nodejs-packaging | 2021.06-6.module+el8.10.0+40171+8fa9c325 |
| rocky 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+40048+6d99f608 |
| rocky 8 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+40368+1252295d |
| rocky 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+40368+1252295d |
| rocky 9 | nodejs:24::nodejs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-devel | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-docs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-full-i18n | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-libs | 1:24.21.0-1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::nodejs-nodemon | 3.1.14-3.module+el9.8.0+40281+14cc6568 |
| rocky 9 | nodejs:24::nodejs-packaging | 2021.06-6.module+el9.8.0+40164+8921ab53 |
| rocky 9 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module+el9.7.0+40165+d075e3f2 |
| rocky 9 | nodejs:24::npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+40367+53e75021 |
| rocky 9 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+40367+53e75021 |
| wolfi | code-server | 4.139.1-r2 |
| wolfi | lerna | 10.0.1-r11 |
| wolfi | node-gyp | 13.0.2-r1 |
| wolfi | prism | 5.16.0-r14 |
Références
- https://access.redhat.com/errata/RHSA-2026:73838
- https://access.redhat.com/security/cve/CVE-2026-84961
- https://advisory.echohq.com/cve/CVE-2026-84961
- https://bugzilla.redhat.com/2528717
- https://bugzilla.redhat.com/2528735
- https://bugzilla.redhat.com/2528759
- https://bugzilla.redhat.com/show_bug.cgi?id=2528717
- https://bugzilla.redhat.com/show_bug.cgi?id=2528735
Les 26 références
- https://bugzilla.redhat.com/show_bug.cgi?id=2528759
- https://cna.openjsf.org/security-advisories.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84961
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85152
- https://errata.almalinux.org/9/ALSA-2026-73838.html
- https://errata.rockylinux.org/RLSA-2026:73838
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390
- https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3
- https://linux.oracle.com/cve/CVE-2026-84961.html
- https://linux.oracle.com/errata/ELSA-2026-74085.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-84961
- https://www.cve.org/CVERecord?id=CVE-2026-84961