Detections
Analytics

Chainguard: node-gyp: security update to 13.1.0-r1

critical Tenable Self-Hosted Container Security Plugin ID 477501

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and
 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone
 before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-
 supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the
 TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject,
 but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the
 default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications
 use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications
 that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key
 pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls
 option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should
 upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead
 of tls, or for proxied destinations use requestTls and proxyTls. (CVE-2026-109383)

Solution

Update the node-gyp library and its related packages to version 13.1.0-r1 or later.

Plugin Details

Severity: Critical

ID: 477501

Version: Revision 1.1

Type: Local

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.49

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-109383

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109383