Detections
Analytics
SCA: security update for undici (GHSA-qrxm-fqhp-jwvm)
high Tenable Self-Hosted Container Security Plugin ID 477583
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and
8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection
is established and presents a different, CA-trusted certificate whose hostname does not match the
requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the
socket with a certificate-altname error, but undici's established-socket error handler asserted that this
error code could never occur, so the peer-controlled error became an uncaught assertion that terminates
the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS
endpoint reached through undici or the global fetch() can crash the client with a single server-initiated
renegotiation, taking down all in-flight requests and background work in the process, and exploitation
needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid
certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed
in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a
workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target
endpoints support it. (CVE-2026-87018)
Solution
Update the undici library and its related packages to version 6.29.1 or later.See Also
Plugin Details
Severity: High
ID: 477583
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/27/2026
Updated: 10/27/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.7
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-87018
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/27/2026
Vulnerability Publication Date: 10/15/2026
Reference Information
CVE: CVE-2026-87018