Detections
Analytics

Chainguard: pelias-api: security update to 7.11.0-r3

high Tenable Cloud Security Plugin ID 477462

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0,
 and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server
 returns a response with more than five content codings and closes the connection before sending the body.
 undici rejects such responses because of a content-encoding limit, but it created the internal response
 stream before that check and returned without attaching an error listener or aborting the request, so the
 early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an
 unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a
 single response, even when the application correctly catches the fetch() rejection, resulting in a denial
 of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of
 those versions or later. There is no workaround. (CVE-2026-109869)

Solution

Update the pelias-api library and its related packages to version 7.11.0-r3 or later.

Plugin Details

Severity: High

ID: 477462

Version: Revision 1.1

Type: Local

Published: 10/26/2026

Updated: 10/26/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.04

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-109869

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109869