Detections
Analytics

Chainguard: node-gyp: security update to 13.1.0-r1

high Tenable Cloud Security Plugin ID 477500

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and
 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be
 driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame
 received, the client automatically writes a PONG response and ignores the backpressure signal from the
 socket write, so a server that streams small PING frames while never reading the client's PONGs makes the
 outbound write queue and heap grow without bound until the Node.js process runs out of memory and
 terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is
 asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the
 only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing
 when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound
 queue, and users should upgrade to one of those versions or later. There is no workaround.
 (CVE-2026-109932)

Solution

Update the node-gyp library and its related packages to version 13.1.0-r1 or later.

Plugin Details

Severity: High

ID: 477500

Version: Revision 1.1

Type: Local

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.04

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-109932

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109932