Summary
[24.21.0-1.0.1]
- Add c-ares as dependency [orabug 39781256]
- Update upstream references
[1:24.21.0-1]
- Update to version 24.21.0
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | nodejs24 | 1:24.21.0-1.0.1.el10_2 |
| Oracle Linux · 10 | nodejs24-devel | 1:24.21.0-1.0.1.el10_2 |
| Oracle Linux · 10 | nodejs24-docs | 1:24.21.0-1.0.1.el10_2 |
| Oracle Linux · 10 | nodejs24-full-i18n | 1:24.21.0-1.0.1.el10_2 |
| Oracle Linux · 10 | nodejs24-libs | 1:24.21.0-1.0.1.el10_2 |
| Oracle Linux · 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 |
Vulnerabilities 3
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.4
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIde…
-
High 7.4
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or …