[Git][security-tracker-team/security-tracker][master] Add Debian bug references for node-undici issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a7518b44 by Salvatore Bonaccorso at 2026-06-19T08:01:30+02:00
Add Debian bug references for node-undici issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -393,15 +393,15 @@ CVE-2024-27928 (vantage6 is an open-source infrastructure for privacy preserving
 CVE-2024-24769 (vantage6 is an open-source infrastructure for privacy preserving analy ...)
 	NOT-FOR-US: vantage6
 CVE-2026-9697 (Impact: undici's ProxyAgent silently drops the requestTls option when  ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
 CVE-2026-9690 (Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4. ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-9679 (Impact: undici's cookie parser in parseSetCookie percent-decodes cooki ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv
 CVE-2026-9678 (Impact: Undici's cache interceptor incorrectly classifies some respons ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6
 CVE-2026-9675 (Impact: The undici WebSocket client enforces maxPayloadSize per-frame  ...)
 	- node-undici <not-affected> (Vulnerable code not present)
@@ -423,10 +423,10 @@ CVE-2026-7850 (The WP Magnific Popup WordPress plugin through 1.0 does not prope
 CVE-2026-7300 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') ...)
 	NOT-FOR-US: RTI Connext
 CVE-2026-6734 (Impact: When using Socks5ProxyAgent, undici reuses a single connection ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
 CVE-2026-6733 (Impact: Undici's HTTP/1.1 client is vulnerable to response queue poiso ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52
 CVE-2026-5667 (Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Roo ...)
 	NOT-FOR-US: Mitsubishi
@@ -817,7 +817,7 @@ CVE-2026-12199 (A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 al
 CVE-2026-12165 (The Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayP ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-12151 (Impact: The undici WebSocket client enforces maxPayloadSize on the cum ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q
 CVE-2026-12115 (The Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to Wo ...)
 	NOT-FOR-US: WordPress plugin
@@ -828,7 +828,7 @@ CVE-2026-11858 (Quanos SCHEMA ST4 on-premises contains a local privilege escalat
 CVE-2026-11857 (Quanos SCHEMA ST4 on-premises contains a local privilege escalation vu ...)
 	TODO: check
 CVE-2026-11525 (Impact: When undici parses a Set-Cookie header, it accepts any SameSit ...)
-	- node-undici <unfixed>
+	- node-undici <unfixed> (bug #1140363)
 	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m
 CVE-2026-11311 (When NGINX Plus is configured as the data plane for NGINX Gateway Fabr ...)
 	TODO: check



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7518b441fabef10f15cffad7330b40c11577a2e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7518b441fabef10f15cffad7330b40c11577a2e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260619/92945e75/attachment.htm>