{"url":"http://public2.vulnerablecode.io/api/packages/73416?format=json","purl":"pkg:npm/undici@7.18.2","type":"npm","namespace":"","name":"undici","version":"7.18.2","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"7.24.0","latest_non_vulnerable_version":"7.24.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65043?format=json","vulnerability_id":"VCID-45gc-naw6-bbhw","summary":"undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1526.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1526.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1526","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.06044","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.06082","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.0607","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.06067","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.06019","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1526"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:06Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://datatracker.ietf.org/doc/html/rfc7692","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:06Z/"}],"url":"https://datatracker.ietf.org/doc/html/rfc7692"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:06Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"},{"reference_url":"https://hackerone.com/reports/3481206","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:06Z/"}],"url":"https://hackerone.com/reports/3481206"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526"},{"reference_url":"https://owasp.org/www-community/attacks/Denial_of_Service","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://owasp.org/www-community/attacks/Denial_of_Service"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130880","reference_id":"1130880","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130880"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142","reference_id":"2447142","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142"},{"reference_url":"https://github.com/advisories/GHSA-vrm6-8vpv-qv8q","reference_id":"GHSA-vrm6-8vpv-qv8q","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vrm6-8vpv-qv8q"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:13826","reference_id":"RHSA-2026:13826","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:17789","reference_id":"RHSA-2026:17789","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21772","reference_id":"RHSA-2026:21772","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21931","reference_id":"RHSA-2026:21931","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21931"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5807","reference_id":"RHSA-2026:5807","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7080","reference_id":"RHSA-2026:7080","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7123","reference_id":"RHSA-2026:7123","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7302","reference_id":"RHSA-2026:7302","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7310","reference_id":"RHSA-2026:7310","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7983","reference_id":"RHSA-2026:7983","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:9742","reference_id":"RHSA-2026:9742","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:9742"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-1526","GHSA-vrm6-8vpv-qv8q"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-45gc-naw6-bbhw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65036?format=json","vulnerability_id":"VCID-djz1-s227-aqae","summary":"undici: undici: Denial of Service via crafted WebSocket frame with large length","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1528.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1528.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1528","reference_id":"","reference_type":"","scores":[{"value":"0.0012","scoring_system":"epss","scoring_elements":"0.30514","published_at":"2026-06-09T12:55:00Z"},{"value":"0.0012","scoring_system":"epss","scoring_elements":"0.30594","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0012","scoring_system":"epss","scoring_elements":"0.30561","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0012","scoring_system":"epss","scoring_elements":"0.3053","published_at":"2026-06-07T12:55:00Z"},{"value":"0.0012","scoring_system":"epss","scoring_elements":"0.30497","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1528"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:03:59Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:03:59Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"},{"reference_url":"https://hackerone.com/reports/3537648","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:03:59Z/"}],"url":"https://hackerone.com/reports/3537648"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130883","reference_id":"1130883","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130883"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145","reference_id":"2447145","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145"},{"reference_url":"https://github.com/advisories/GHSA-f269-vfmq-vjvj","reference_id":"GHSA-f269-vfmq-vjvj","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f269-vfmq-vjvj"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:13826","reference_id":"RHSA-2026:13826","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:17789","reference_id":"RHSA-2026:17789","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21772","reference_id":"RHSA-2026:21772","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21931","reference_id":"RHSA-2026:21931","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21931"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5807","reference_id":"RHSA-2026:5807","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7080","reference_id":"RHSA-2026:7080","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7123","reference_id":"RHSA-2026:7123","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7302","reference_id":"RHSA-2026:7302","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7310","reference_id":"RHSA-2026:7310","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7983","reference_id":"RHSA-2026:7983","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:9742","reference_id":"RHSA-2026:9742","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:9742"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-1528","GHSA-f269-vfmq-vjvj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-djz1-s227-aqae"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65033?format=json","vulnerability_id":"VCID-gxjd-vjjz-6ydx","summary":"undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2229.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2229.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2229","reference_id":"","reference_type":"","scores":[{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38683","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38725","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38728","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38701","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38673","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2229"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:06:30Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://datatracker.ietf.org/doc/html/rfc7692","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:06:30Z/"}],"url":"https://datatracker.ietf.org/doc/html/rfc7692"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:06:30Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"},{"reference_url":"https://hackerone.com/reports/3487486","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:06:30Z/"}],"url":"https://hackerone.com/reports/3487486"},{"reference_url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-13T13:06:30Z/"}],"url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130884","reference_id":"1130884","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130884"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143","reference_id":"2447143","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143"},{"reference_url":"https://github.com/advisories/GHSA-v9p9-hfj2-hcw8","reference_id":"GHSA-v9p9-hfj2-hcw8","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v9p9-hfj2-hcw8"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:13826","reference_id":"RHSA-2026:13826","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:17789","reference_id":"RHSA-2026:17789","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21772","reference_id":"RHSA-2026:21772","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21931","reference_id":"RHSA-2026:21931","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21931"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5807","reference_id":"RHSA-2026:5807","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7080","reference_id":"RHSA-2026:7080","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7123","reference_id":"RHSA-2026:7123","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7302","reference_id":"RHSA-2026:7302","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7310","reference_id":"RHSA-2026:7310","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7983","reference_id":"RHSA-2026:7983","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:9742","reference_id":"RHSA-2026:9742","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:9742"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-2229","GHSA-v9p9-hfj2-hcw8"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gxjd-vjjz-6ydx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65039?format=json","vulnerability_id":"VCID-kszv-djap-ebgj","summary":"undici: Undici: HTTP header injection and request smuggling vulnerability","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1527.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1527.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1527","reference_id":"","reference_type":"","scores":[{"value":"0.00012","scoring_system":"epss","scoring_elements":"0.019","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00012","scoring_system":"epss","scoring_elements":"0.01923","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00012","scoring_system":"epss","scoring_elements":"0.01929","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00012","scoring_system":"epss","scoring_elements":"0.0192","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00012","scoring_system":"epss","scoring_elements":"0.01906","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1527"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:05:24Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:05:24Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq"},{"reference_url":"https://hackerone.com/reports/3487198","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:05:24Z/"}],"url":"https://hackerone.com/reports/3487198"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130882","reference_id":"1130882","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130882"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141","reference_id":"2447141","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141"},{"reference_url":"https://github.com/advisories/GHSA-4992-7rv2-5pvq","reference_id":"GHSA-4992-7rv2-5pvq","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4992-7rv2-5pvq"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-1527","GHSA-4992-7rv2-5pvq"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kszv-djap-ebgj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65046?format=json","vulnerability_id":"VCID-uqjt-abfk-9kf6","summary":"undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1525.json","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1525.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1525","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05189","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05205","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05191","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05183","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05144","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1525"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:44:24Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://cwe.mitre.org/data/definitions/444.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:44:24Z/"}],"url":"https://cwe.mitre.org/data/definitions/444.html"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:44:24Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"},{"reference_url":"https://hackerone.com/reports/3556037","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:44:24Z/"}],"url":"https://hackerone.com/reports/3556037"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525"},{"reference_url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:44:24Z/"}],"url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130879","reference_id":"1130879","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130879"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144","reference_id":"2447144","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144"},{"reference_url":"https://github.com/advisories/GHSA-2mjp-6q6p-2qxm","reference_id":"GHSA-2mjp-6q6p-2qxm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2mjp-6q6p-2qxm"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:13826","reference_id":"RHSA-2026:13826","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:17789","reference_id":"RHSA-2026:17789","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:21772","reference_id":"RHSA-2026:21772","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7080","reference_id":"RHSA-2026:7080","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7123","reference_id":"RHSA-2026:7123","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7302","reference_id":"RHSA-2026:7302","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7310","reference_id":"RHSA-2026:7310","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7983","reference_id":"RHSA-2026:7983","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:9742","reference_id":"RHSA-2026:9742","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:9742"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-1525","GHSA-2mjp-6q6p-2qxm"],"risk_score":3.3,"exploitability":"0.5","weighted_severity":"6.6","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uqjt-abfk-9kf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65041?format=json","vulnerability_id":"VCID-yzqg-ucp5-rugh","summary":"undici: Undici: Denial of Service due to uncontrolled resource consumption","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2581.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2581.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2581","reference_id":"","reference_type":"","scores":[{"value":"0.0002","scoring_system":"epss","scoring_elements":"0.05698","published_at":"2026-06-09T12:55:00Z"},{"value":"0.0002","scoring_system":"epss","scoring_elements":"0.0572","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0002","scoring_system":"epss","scoring_elements":"0.05706","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0002","scoring_system":"epss","scoring_elements":"0.05707","published_at":"2026-06-07T12:55:00Z"},{"value":"0.0002","scoring_system":"epss","scoring_elements":"0.05664","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2581"},{"reference_url":"https://cna.openjsf.org/security-advisories.html","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:49Z/"}],"url":"https://cna.openjsf.org/security-advisories.html"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:49Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"},{"reference_url":"https://hackerone.com/reports/3513473","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-13T18:04:49Z/"}],"url":"https://hackerone.com/reports/3513473"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130885","reference_id":"1130885","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130885"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140","reference_id":"2447140","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140"},{"reference_url":"https://github.com/advisories/GHSA-phc3-fgpg-7m6h","reference_id":"GHSA-phc3-fgpg-7m6h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-phc3-fgpg-7m6h"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7350","reference_id":"RHSA-2026:7350","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7670","reference_id":"RHSA-2026:7670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:7675","reference_id":"RHSA-2026:7675","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:7675"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112590?format=json","purl":"pkg:npm/undici@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.24.0"}],"aliases":["CVE-2026-2581","GHSA-phc3-fgpg-7m6h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yzqg-ucp5-rugh"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49715?format=json","vulnerability_id":"VCID-z9w9-u6qu-yyd2","summary":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion\nThe `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.\n\nHowever, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22036.json","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22036.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22036","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06885","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06925","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06929","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06915","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06877","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22036"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/nodejs/undici","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nodejs/undici"},{"reference_url":"https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-14T19:17:52Z/"}],"url":"https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125679","reference_id":"1125679","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125679"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429741","reference_id":"2429741","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429741"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22036","reference_id":"CVE-2026-22036","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22036"},{"reference_url":"https://github.com/advisories/GHSA-g9mf-h72j-4rw9","reference_id":"GHSA-g9mf-h72j-4rw9","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g9mf-h72j-4rw9"},{"reference_url":"https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9","reference_id":"GHSA-g9mf-h72j-4rw9","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-14T19:17:52Z/"}],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73417?format=json","purl":"pkg:npm/undici@6.23.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-45gc-naw6-bbhw"},{"vulnerability":"VCID-djz1-s227-aqae"},{"vulnerability":"VCID-gxjd-vjjz-6ydx"},{"vulnerability":"VCID-kszv-djap-ebgj"},{"vulnerability":"VCID-uqjt-abfk-9kf6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@6.23.0"},{"url":"http://public2.vulnerablecode.io/api/packages/73416?format=json","purl":"pkg:npm/undici@7.18.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-45gc-naw6-bbhw"},{"vulnerability":"VCID-djz1-s227-aqae"},{"vulnerability":"VCID-gxjd-vjjz-6ydx"},{"vulnerability":"VCID-kszv-djap-ebgj"},{"vulnerability":"VCID-uqjt-abfk-9kf6"},{"vulnerability":"VCID-yzqg-ucp5-rugh"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.18.2"}],"aliases":["CVE-2026-22036","GHSA-g9mf-h72j-4rw9"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z9w9-u6qu-yyd2"}],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/undici@7.18.2"}