Threats Tagged 'cve-2026-85024'

CVE-2026-84292 is a vulnerability in the node-ajv package where the fast-uri component serializes the port part of a URI without validating it. This issue is part of a set of vulnerabilities addressed in a Red Hat Hardened Images RPM security update affecting multiple Red Hat products. The vulnerability has a CVSS score of 7.5 (medium severity) and impacts integrity without affecting confidentiality or availability. A patch is available from Red Hat as part of their security advisory RHSA-2026:63782.

Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, specifically updating nodejs24 and nodejs26 packages. The advisory includes bug fixes and enhancements for CVE-2026-18540, CVE-2026-19534, CVE-2026-84961, and CVE-2026-85024. Updated packages cover architectures including aarch64 and x86_64. No known exploits have been reported in the wild. The advisory provides updated package versions to mitigate these vulnerabilities.

A vulnerability in the undici WebSocket client for Node.js causes the process to crash when processing a specially crafted permessage-deflate compressed message that exceeds the decompressed payload size limit and contains a malformed DEFLATE block. This triggers an unhandled error in the internal zlib InflateRaw stream, leading to process termination. The issue affects undici versions 6.25.0 through before 6.28.1, 7.28.0 through before 7.29.1, and 8.1.0 through before 8.10.2. No workaround is available, but patched versions have been released.