Detections
Analytics

Chainguard: node-gyp: security update to 13.1.0-r1

high Tenable Self-Hosted Container Security Plugin ID 477510

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1,
 its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream
 event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts
 a synchronous throw from a downstream handler into a per-request failure, that protection is absent when
 the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by
 design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum
 size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised
 HTTP server can crash any client that composes the decompress interceptor with such a handler by returning
 a small compressed body that decompresses to more than the configured limit, so only the decompressed size
 matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users
 should upgrade to one of those versions or later. As a workaround, avoid composing the decompress
 interceptor with a response handler that throws during response processing until upgrading.
 (CVE-2026-87029)

Solution

Update the node-gyp library and its related packages to version 13.1.0-r1 or later.

Plugin Details

Severity: High

ID: 477510

Version: Revision 1.1

Type: Local

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.04

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-87029

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-87029