[Git][security-tracker-team/security-tracker][master] new node-undici issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
35953b4f by Moritz Muehlenhoff at 2026-10-15T21:55:34+02:00
new node-undici issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -37,9 +37,11 @@ CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity (XXE)
 CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extra ...)
 	TODO: check
 CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6
 CVE-2026-87018 (undici is an HTTP client library for Node.js. In versions 4.2.1 throug ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm
 CVE-2026-85634 (A flaw was found in the ContentRepositoryImpl.copyExplodedContent func ...)
 	TODO: check
 CVE-2026-84731 (An unauthenticated remote attacker can bypass authentication and gain  ...)
@@ -514,9 +516,11 @@ CVE-2026-110361 (Insertion of Sensitive Information Into Sent Data vulnerability
 CVE-2026-110360 (Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax- ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109932 (undici is an HTTP client library for Node.js. In versions 5.15.0 throu ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6
 CVE-2026-109924 (undici is an HTTP client library for Node.js. In versions 6.5.0 throug ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
 CVE-2026-109897 (Missing Authorization vulnerability in WP Chill Strong Testimonials st ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109893 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -524,13 +528,19 @@ CVE-2026-109893 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-109892 (Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109869 (undici is an HTTP client library for Node.js. In versions 6.23.0 throu ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
 CVE-2026-109855 (undici is an HTTP client library for Node.js. In versions 8.11.0 and 8 ...)
-	TODO: check
+	- node-undici <unfixed>
+	[trixie] - node-undici <not-affected> (Vulnerable code not present, only affects 8.x)
+	[bookworm] - node-undici <not-affected> (Vulnerable code not present, only affects 8.x)
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
 CVE-2026-109841 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472
 CVE-2026-109829 (undici is an HTTP client library for Node.js. In versions 7.0.0 throug ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
 CVE-2026-109702 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109698 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
@@ -556,7 +566,8 @@ CVE-2026-109449 (InSymfony Expression Language versions prior to 5.4.54, 6.4.48,
 CVE-2026-109413 (In Symfony YAML prior to versions5.4.54,6.4.45,7.4.18, and8.1.6,Yaml\P ...)
 	TODO: check
 CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions 4.0.0 throug ...)
-	TODO: check
+	- node-undici <unfixed>
+	NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
 CVE-2026-109131 (The Hub collection module documentation renderer in the unified Ansibl ...)
 	TODO: check
 CVE-2026-108499 (Missing Authorization vulnerability in WebberZone Knowledge Base knowl ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/35953b4fb408b8b514ce3776e5501f2303b2315b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/35953b4fb408b8b514ce3776e5501f2303b2315b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/1e51f250/attachment-0001.htm>