{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"node-undici","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPYJ5ZW9QKWDSNPWZ593KH","modified_at":"2026-11-01T05:00:06.159745621Z","published_at":"2026-10-15T19:17:21.513Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-109829","https://security-tracker.debian.org/tracker/CVE-2026-109829"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-109829#Debian:13/node-undici","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-109829"}],"summary":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shar"}