Detections
Analytics

Chainguard: node-gyp: security update to 13.1.0-r1

critical Tenable Self-Hosted Container Security Plugin ID 477504

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1,
 when an originless Agent composes the redirect and cache interceptors in that order with a shared cache
 store, the cache builds its key from the original request URL before the redirect handler changes the
 origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker
 who controls the target of a redirect from a trusted URL can have their response cached under that trusted
 URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a
 private, non-stored redirect response to a user-specific resource be stored under the original URL and
 served to a later unauthenticated caller, disclosing private data. Applications are affected only when an
 originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is
 fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and
 preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those
 versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use
 per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
 (CVE-2026-109829)

Solution

Update the node-gyp library and its related packages to version 13.1.0-r1 or later.

Plugin Details

Severity: Critical

ID: 477504

Version: Revision 1.1

Type: Local

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.49

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-109829

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109829