RHSA-2026:54438 | Vulnetix

RHSA-2026:54438 PUBLISHED CVSS 7.400000095367432 HIGH

A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.

Risk Scores

CVSS 3.1

7.400000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	nodejs24-main@noarch as a component of Red Hat Hardened Images	*
Red Hat	nodejs24-main@src as a component of Red Hat Hardened Images	*
Red Hat	nodejs24-main@x86_64 as a component of Red Hat Hardened Images	*
Red Hat	nodejs24-main@aarch64 as a component of Red Hat Hardened Images	*

Timeline

Aug 12, 2026 CVE Published
Sep 9, 2026 CVE Updated
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:54438 advisory
https://images.redhat.com/ advisory
https://access.redhat.com/security/cve/CVE-2026-85152 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://access.redhat.com/security/cve/CVE-2026-18149 advisory
https://access.redhat.com/security/cve/CVE-2026-84933 advisory
https://access.redhat.com/security/cve/CVE-2026-85008 advisory
https://access.redhat.com/security/cve/CVE-2026-84890 advisory
https://access.redhat.com/security/cve/CVE-2026-85014 advisory
https://access.redhat.com/security/cve/CVE-2026-48932 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54438.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528802 issue
https://www.cve.org/CVERecord?id=CVE-2026-18149 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18149 advisory
https://cna.openjsf.org/security-advisories.html advisory
https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528772 issue
https://www.cve.org/CVERecord?id=CVE-2026-84890 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84890 advisory
https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm advisory

…and 16 more

Open in Interactive Console →