Detections
Analytics

Chainguard: pelias-api: security update to 7.11.0-r3

high Tenable Cloud Security Plugin ID 477463

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and
 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or
 compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event
 separator, or a single unfinished line split across many chunks, the parser retains a growing amount of
 per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound,
 and because maxResponseSize is enforced on the compressed body before decompression, a small compressed
 response can expand into enough retained memory to terminate the process. An application only needs to
 maintain an EventSource connection to an untrusted peer, which controls only the response, and
 availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the
 retained parser state independently of the byte limits, and users should upgrade to one of those versions
 or later. There is no workaround. (CVE-2026-109924)

Solution

Update the pelias-api library and its related packages to version 7.11.0-r3 or later.

Plugin Details

Severity: High

ID: 477463

Version: Revision 1.1

Type: Local

Published: 10/26/2026

Updated: 10/26/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.7

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-109924

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109924