Skip to content
OpenAdvisories
High RHSA-2026:84706 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs24 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-bin 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-devel 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-docs 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-full-i18n 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-libs 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-npm 0:11.19.0-1.24.21.0.1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-npm-bin 0:24.21.0-1.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 v8-13.6-devel 0:13.6.233.17-1.24.21.0.1.5.hum1

Vulnerabilities 8

  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109829

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original …

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-109841

    undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI spec…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-109924

    undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

    undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending mi…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-109932

    undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

    undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious o…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-87029

    undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions tho…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-109383
  • report
    https://access.redhat.com/security/cve/CVE-2026-109829
  • report
    https://access.redhat.com/security/cve/CVE-2026-109841
  • report
    https://access.redhat.com/security/cve/CVE-2026-109869
  • report
    https://access.redhat.com/security/cve/CVE-2026-109924
  • report
    https://access.redhat.com/security/cve/CVE-2026-109932
  • report
    https://access.redhat.com/security/cve/CVE-2026-87018
  • report
    https://access.redhat.com/security/cve/CVE-2026-87029
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84706.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-87018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-87018
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553726
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-87029
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-87029
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109383
  • article
    https://github.com/nodejs/undici/commit/f75eac00ac17
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553679
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109829
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109829
  • article
    https://github.com/nodejs/undici/commit/26c2bfb3def0
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553669
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109841
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109841
  • article
    https://github.com/nodejs/undici/commit/4f7ef6806e53
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109869
  • article
    https://github.com/nodejs/undici/commit/b5084c7dc239