{"action":"Upgrade node-undici to 8.12.2+dfsg+~cs3.2.3-1 or later.","affected":[{"fixed":"8.12.2+dfsg+~cs3.2.3-1","introduced":"0"}],"component":"node-undici","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["8.12.2+dfsg+~cs3.2.3-1"],"id":"tcs_01M5NPYJ9Q4NBEW93QQ9PP7834","modified_at":"2026-11-01T05:00:06.159745621Z","published_at":"2026-10-15T19:17:21.513Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-109829","https://security-tracker.debian.org/tracker/CVE-2026-109829"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-109829#Debian:14/node-undici","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-109829"}],"summary":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shar"}