These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in undici's decompress interceptor allows for asymmetric resource consumption, potentially leading to a denial-of-service (DoS) attack. The vulnerability affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. This issue arises because the decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header, which can lead to an unbou [truncated]
A vulnerability in undici's WebSocket client can cause a Node.js process to crash during the opening handshake when a server responds with an unexpected subprotocol. This issue affects undici versions 6.7.0 to 6.28.1, 7.0.0 to 7.29.1, and 8.0.0 to 8.10.2. Applications using undici's WebSocket client to connect to attacker-controlled or compromised servers, or over plaintext connections, can be remotely cr [truncated]
CVE-2026-18149 debrief based on the supplied source corpus. The undici retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new respo [truncated]
CVE-2026-85152 is a high-severity vulnerability in undici, a Node.js module. It allows cross-origin information disclosure and persistent cache poisoning due to improper cache and request-deduplication key handling. This issue affects undici versions from 8.10.0 to 8.10.2. Applications using an Agent are not affected. Users should upgrade to undici 8.10.2.
A remote, unauthenticated attacker can crash the Node.js process running undici by sending a specially crafted compressed WebSocket payload that exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte. This issue affects undici versions 6.25.0 to 6.28.1, 7.28.0 to 7.29.1, and 8.1.0 to 8.10.2. The vulnerability stems from the permessage-deflate size-limit cleanup removing all l [truncated]
CVE-2026-84961 debrief based on the supplied source corpus. The CVE record was published on 2026-09-04T17:17:02.227Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects undici's BalancedPool constructor, which discards custom TLS options, potentially allowing unintended acceptance of peers. Defenders and developers using undici should assess exposure, veri [truncated]
CVE-2026-84933 is a vulnerability in undici's cache interceptor that allows sensitive cookie information to be disclosed between different callers in shared cache mode. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2. The vulnerability arises from improper handling of the Set-Cookie response header, leading to potential unau [truncated]
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted h [truncated]
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x. The vulnerability is caused by a flaw in Node.js that can cause dns.resolveAny() to abort the Node.js process when a DNS response contains more than 256 A r [truncated]
The CVE-2026-56846 vulnerability is related to a flaw in Node.js HTTP/2 handling, which can cause HTTP/2 retained header blocks to evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js versions 24.x and 22.x. Organizations using these versions should be aware of this vulnerability and take steps to mitigate it. The CVE record was published on 2026-08-04T01:16:19.84 [truncated]
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. The vulnerability affects Node.js 22.x, 24.x, and 26.x. Defenders and administrators responsible for Node.js installations should be aware of this vulnerability a [truncated]
The CVE-2026-58043 vulnerability in Node.js arises from a flaw in the Permission Model enforcement, leading to over-granted filesystem access across radix-tree prefix boundaries. This issue affects Node.js main, 22.x, 24.x, and 26.x versions. The vulnerability allows an attacker granted access to one path to exploit boundary handling and read from or write to paths outside the intended filesystem allowlis [truncated]
CVE-2026-58040 is an incomplete fix for CVE-2026-48934 in Node.js, affecting versions 22.x, 24.x, and 26.x. The vulnerability involves HTTPS Agent TLS session reuse skipping hostname verification across identity policies. Node.js users and administrators should assess and remediate this vulnerability. The CVE record was published on 2026-07-30T06:25:55.190Z and has not been modified since then. This incom [truncated]
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x. The vulnerability allows an attacker to potentially bypass security controls and access sensitive information. Organizations using Node.js v [truncated]
The CVE-2026-56847 vulnerability involves a flaw in the Node.js Permission Model enforcement, specifically allowing `trace_events.createTracing().enable()` to write trace logs outside of the `--allow-fs-write` directive. This can lead to a confidentiality impact or bypass of the intended security boundary under affected configurations. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x. Organ [truncated]
The undici library's setCookie function does not fully sanitize cookie attributes, allowing attacker-influenced input to inject additional attributes. This issue affects undici versions before 6.28.0, 7.29.0, and 8.9.0. The vulnerability can lead to SameSite CSRF protections bypass and attribute manipulation. Affected applications pass user-controlled input to cookie attributes, such as multi-tenant or re [truncated]
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 4.3, with a Medium severity rating. The vulnerability was published on June 26, 2026, and last modified on June 29, 2026. Node.js has r [truncated]
A flaw was found in the Node.js WebCrypto implementation. The vulnerability occurs when the input to `subtle.encrypt()` is a multiple of 2GiB, causing the process to crash. This issue affects all supported release lines of Node.js, specifically Node.js 22, Node.js 24, and Node.js 26. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 7.5, with a severity rating of HIGH. The CVE [truncated]
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0, causing the flow control window to exceed the maximum value of 2³¹-1. The server sends a GOAWAY frame but fails to clean up the Http2Session object. This vulnerability affects Node.js versions 20, 22, 24, and 25, potentially exposing these systems to memory leaks. The technical impact involves increased me [truncated]
A flaw exists in Node.js Permission Model network enforcement, leaving Unix Domain Socket (UDS) server operations without required permission checks. Code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This affects Node.js 25.x processes using th [truncated]
CVE-2026-21710 is a flaw in Node.js HTTP request handling that causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct. This occurs because dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. The exception is thrown synchronously inside a property getter and cannot be [truncated]
CVE-2026-2229 is a high-severity vulnerability in the undici WebSocket client, allowing for a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. A malicious server can respond with an out-of-range server_max_window_bits value, causing the client to crash. The vulnerability exists due to inadequate validation and exception handli [truncated]
CVE-2026-1528 is a high-severity vulnerability in the Node.js Undici library. The vulnerability occurs when a server replies with a WebSocket frame using the 64-bit length form and an extremely large length, causing undici's ByteParser to overflow internal math, resulting in an invalid state and a fatal TypeError that terminates the process. The vulnerability was patched in undici versions v7.24.0 and v6. [truncated]
CVE-2026-1526 is a high-severity denial-of-service vulnerability in the undici WebSocket client. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold. A malicious WebSocket server can send a small compressed frame that expands to [truncated]
CVE-2025-55131 is a high-severity vulnerability in Node.js that exposes uninitialized memory when allocations are interrupted, potentially leaking in-process secrets or causing data corruption. The flaw is related to the buffer allocation logic and can be exploited under specific timing conditions. This vulnerability affects Node.js versions and can be triggered when using the `vm` module with the timeout [truncated]
CVE-2025-55130 is a critical vulnerability in Node.js's Permissions model. This flaw allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables [truncated]
CVE-2024-27983 is a high-severity denial-of-service vulnerability in Node.js affecting Siemens SINEC INS. The vulnerability stems from an assertion failure in `node::http2::Http2Session::~Http2Session()` that can be triggered by sending a small amount of HTTP/2 frame packets. An unauthenticated remote attacker can exploit this to crash the HTTP/2 server. The vulnerability was published on November 12, 202 [truncated]
CVE-2024-24758 describes an information disclosure vulnerability in Undici, an HTTP/1.1 client for Node.js. While Undici properly clears Authorization headers during cross-origin redirects, it fails to clear Proxy-Authentication headers, potentially exposing proxy credentials to unintended destinations. This vulnerability affects Siemens SINEC INS, which incorporates the vulnerable Undici component. The i [truncated]
CVE-2024-22025 is a denial-of-service vulnerability in Node.js affecting Siemens SINEC INS, published 2024-11-12. The vulnerability stems from resource exhaustion during fetch() brotli decoding, where a remote attacker can send a specially crafted request to trigger a DoS condition. The CVSS 3.1 score of 5.3 (MEDIUM) reflects network accessibility with low attack complexity, no required privileges or user [truncated]