VDB
CVE-2026-87018
CVE-2026-87018
PUBLISHED
CVSS 7.5 HIGH
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
EPSS 0.19% · 8.4th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.19%
8.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| undici | undici | 8.12.2, 6.29.1, 7.0.0 |
| npm | undici | 4.2.1, 7.0.0, 8.0.0 |
| wolfi | node-gyp | 0 |
Timeline
- Oct 15, 2026 Coalition ESS Score
- Oct 15, 2026 CVE Published
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 30, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-87018 advisory
- https://github.com/advisories/GHSA-qrxm-fqhp-jwvm advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm url
- https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309 patch
- https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28 patch
- https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8 patch
- https://cna.openjsf.org/security-advisories.html url
- https://github.com/nodejs/undici/releases/tag/v6.29.1 url
- https://github.com/nodejs/undici/releases/tag/v7.30.1 url
- https://github.com/nodejs/undici/releases/tag/v8.12.2 url