Skip to content
OpenAdvisories
High RHSA-2026:87703 7 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs26 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-bin 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-devel 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-docs 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-full-i18n 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-libs 1:26.12.1-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-npm 1:11.20.0-1.26.12.1.0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-npm-bin 1:26.12.1-0.1.hum1

Vulnerabilities 7

  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-105483 Public exploit

    A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-109924

    undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

    undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending mi…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-109932

    undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

    undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious o…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-87018
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-109932
  • report
    https://access.redhat.com/security/cve/CVE-2026-109924
  • report
    https://access.redhat.com/security/cve/CVE-2026-109383
  • report
    https://access.redhat.com/security/cve/CVE-2026-109869
  • report
    https://access.redhat.com/security/cve/CVE-2026-105482
  • report
    https://access.redhat.com/security/cve/CVE-2026-105483
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87703.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-87018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-87018
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559875
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-105482
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-105482
  • article
    https://nodejs.org/en/blog/release/v22.23.4
  • article
    https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559870
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-105483
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-105483
  • article
    https://nodejs.org/en/blog/release/v24.22.1
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109383
  • article
    https://github.com/nodejs/undici/commit/f75eac00ac17
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109869
  • article
    https://github.com/nodejs/undici/commit/b5084c7dc239
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553663
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109924
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109924
  • article
    https://github.com/nodejs/undici/commit/789ef26461c
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685