[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-2229":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":25,"aliases":26,"duplicate_of":9,"upstream":28,"downstream":29,"duplicates":50,"related":51,"reserved_at":9,"published_at":54,"modified_at":55,"state":56,"summary":57,"references_raw":66,"kevs":179,"epss":180,"epss_history":183,"metrics":459,"affected":469},"CVE-2026-2229","ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n  *  The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n  *  The createInflateRaw() call is not wrapped in a try-catch block\n  *  The resulting exception propagates up through the call stack and crashes the Node.js process",null,[11,19],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-248","Uncaught Exception","An exception is thrown from a function, but it is not caught.","weakness","Draft","Base",[],{"_key":20,"id":20,"name":21,"description":22,"type":15,"status":23,"abstraction":17,"likelihood_of_exploit":9,"capec":24},"CWE-1284","Improper Validation of Specified Quantity in Input","The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.","Incomplete",[],[],[27],"GHSA-v9p9-hfj2-hcw8",[],[30,32,34,36,38,40,42,44,46,48],{"_key":31},"DEBIAN-CVE-2026-2229",{"_key":33},"UBUNTU-CVE-2026-2229",{"_key":35},"RHSA-2026:7080",{"_key":37},"RHSA-2026:7123",{"_key":39},"RHSA-2026:7302",{"_key":41},"RHSA-2026:7310",{"_key":43},"RHSA-2026:7350",{"_key":45},"RHSA-2026:7670",{"_key":47},"RHSA-2026:7675",{"_key":49},"RHSA-2026:7983",[],[52],{"_key":53},"CGA-GMM5-X3FP-M45F","2026-03-12T20:27:05.600Z","2026-07-15T01:19:31.784Z","Analyzed",{"cisa_kev":58,"cisa_ransomware":58,"cisa_vendor":9,"epss_severity":59,"epss_score":60,"severity":61,"severity_score":62,"severity_version":63,"severity_source":64,"severity_vector":65,"severity_status":56},false,"low",0.00874,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[67,75,80,84,89,93,98,103,109,114,119,123,127,131,135,139,143,147,151,155,159,163,167,171,175],{"url":68,"sources":69,"tags":72},"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",[64,70,71],"nvd","osv_npm",[73,74],"WEB","Vendor Advisory",{"url":76,"sources":77,"tags":78},"https://hackerone.com/reports/3487486",[64,70,71],[73,79],"Permissions Required",{"url":81,"sources":82,"tags":83},"https://cna.openjsf.org/security-advisories.html",[64,70,71],[73,74],{"url":85,"sources":86,"tags":87},"https://datatracker.ietf.org/doc/html/rfc7692",[64,70,71],[73,88],"Technical Description",{"url":90,"sources":91,"tags":92},"https://nodejs.org/api/zlib.html#class-zlibinflateraw",[64,70,71],[73,88],{"url":94,"sources":95,"tags":96},"https://nvd.nist.gov/vuln/detail/CVE-2026-2229",[71],[97],"Advisory",{"url":99,"sources":100,"tags":101},"https://github.com/nodejs/undici",[71],[102],"PACKAGE",{"url":104,"sources":105,"tags":106},"https://access.redhat.com/security/cve/CVE-2026-2229",[64],[107,108],"VDB Entry","X Refsource REDHAT",{"url":110,"sources":111,"tags":112},"https://bugzilla.redhat.com/show_bug.cgi?id=2447143",[64],[113,108],"Issue Tracking",{"url":115,"sources":116,"tags":117},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json",[64],[118],"X Sadp Csaf Vex",{"url":120,"sources":121,"tags":122},"https://access.redhat.com/errata/RHSA-2026:17789",[64],[74,108],{"url":124,"sources":125,"tags":126},"https://access.redhat.com/errata/RHSA-2026:7310",[64],[74,108],{"url":128,"sources":129,"tags":130},"https://access.redhat.com/errata/RHSA-2026:7080",[64],[74,108],{"url":132,"sources":133,"tags":134},"https://access.redhat.com/errata/RHSA-2026:7675",[64],[74,108],{"url":136,"sources":137,"tags":138},"https://access.redhat.com/errata/RHSA-2026:7123",[64],[74,108],{"url":140,"sources":141,"tags":142},"https://access.redhat.com/errata/RHSA-2026:7670",[64],[74,108],{"url":144,"sources":145,"tags":146},"https://access.redhat.com/errata/RHSA-2026:7983",[64],[74,108],{"url":148,"sources":149,"tags":150},"https://access.redhat.com/errata/RHSA-2026:7302",[64],[74,108],{"url":152,"sources":153,"tags":154},"https://access.redhat.com/errata/RHSA-2026:7350",[64],[74,108],{"url":156,"sources":157,"tags":158},"https://access.redhat.com/errata/RHSA-2026:9742",[64],[74,108],{"url":160,"sources":161,"tags":162},"https://access.redhat.com/errata/RHSA-2026:13826",[64],[74,108],{"url":164,"sources":165,"tags":166},"https://access.redhat.com/errata/RHSA-2026:5807",[64],[74,108],{"url":168,"sources":169,"tags":170},"https://access.redhat.com/errata/RHSA-2026:21772",[64],[74,108],{"url":172,"sources":173,"tags":174},"https://access.redhat.com/errata/RHSA-2026:21931",[64],[74,108],{"url":176,"sources":177,"tags":178},"https://access.redhat.com/errata/RHSA-2026:34342",[64],[74,108],[],{"date":181,"score":60,"percentile":182},"2026-07-05",0.54551,[184,188,191,194,197,201,205,208,211,215,218,221,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,272,275,278,281,285,288,291,294,297,300,303,306,309,312,315,318,321,324,327,330,333,336,339,342,345,348,351,354,357,360,363,366,369,372,375,378,381,384,387,390,394,397,400,403,406,408,411,414,417,420,423,426,429,432,435,438,441,444,447,450,453,456],{"date":185,"score":186,"percentile":187},"2026-03-13",0.00066,0.20287,{"date":189,"score":186,"percentile":190},"2026-03-14",0.20292,{"date":192,"score":186,"percentile":193},"2026-03-15",0.20222,{"date":195,"score":186,"percentile":196},"2026-03-16",0.20198,{"date":198,"score":199,"percentile":200},"2026-03-17",0.00081,0.23706,{"date":202,"score":203,"percentile":204},"2026-03-18",0.00108,0.28853,{"date":206,"score":203,"percentile":207},"2026-03-19",0.28847,{"date":209,"score":203,"percentile":210},"2026-03-20",0.28896,{"date":212,"score":213,"percentile":214},"2026-03-21",0.00186,0.40303,{"date":216,"score":213,"percentile":217},"2026-03-22",0.40294,{"date":219,"score":213,"percentile":220},"2026-03-23",0.40266,{"date":222,"score":213,"percentile":223},"2026-03-24",0.40275,{"date":225,"score":213,"percentile":226},"2026-03-25",0.40323,{"date":228,"score":213,"percentile":229},"2026-03-26",0.40364,{"date":231,"score":213,"percentile":232},"2026-03-27",0.40403,{"date":234,"score":213,"percentile":235},"2026-03-28",0.40418,{"date":237,"score":213,"percentile":238},"2026-03-29",0.40394,{"date":240,"score":213,"percentile":241},"2026-03-30",0.40387,{"date":243,"score":213,"percentile":244},"2026-03-31",0.4036,{"date":246,"score":213,"percentile":247},"2026-04-01",0.40381,{"date":249,"score":213,"percentile":250},"2026-04-02",0.40468,{"date":252,"score":213,"percentile":253},"2026-04-03",0.40458,{"date":255,"score":213,"percentile":256},"2026-04-04",0.40494,{"date":258,"score":213,"percentile":259},"2026-04-05",0.4046,{"date":261,"score":213,"percentile":262},"2026-04-06",0.40405,{"date":264,"score":213,"percentile":265},"2026-04-07",0.40417,{"date":267,"score":213,"percentile":268},"2026-04-08",0.40467,{"date":270,"score":213,"percentile":271},"2026-04-09",0.40478,{"date":273,"score":213,"percentile":274},"2026-04-10",0.40497,{"date":276,"score":213,"percentile":277},"2026-04-11",0.40499,{"date":279,"score":213,"percentile":280},"2026-04-12",0.40462,{"date":282,"score":283,"percentile":284},"2026-04-13",0.00203,0.42413,{"date":286,"score":283,"percentile":287},"2026-04-14",0.42414,{"date":289,"score":283,"percentile":290},"2026-04-15",0.42461,{"date":292,"score":283,"percentile":293},"2026-04-16",0.42462,{"date":295,"score":283,"percentile":296},"2026-04-17",0.42445,{"date":298,"score":283,"percentile":299},"2026-04-18",0.42437,{"date":301,"score":283,"percentile":302},"2026-04-19",0.42399,{"date":304,"score":283,"percentile":305},"2026-04-20",0.42384,{"date":307,"score":283,"percentile":308},"2026-04-21",0.42366,{"date":310,"score":283,"percentile":311},"2026-04-22",0.42398,{"date":313,"score":283,"percentile":314},"2026-04-23",0.42421,{"date":316,"score":283,"percentile":317},"2026-04-24",0.42302,{"date":319,"score":283,"percentile":320},"2026-04-25",0.42316,{"date":322,"score":283,"percentile":323},"2026-04-26",0.42299,{"date":325,"score":283,"percentile":326},"2026-04-27",0.42275,{"date":328,"score":283,"percentile":329},"2026-04-28",0.42222,{"date":331,"score":283,"percentile":332},"2026-04-29",0.42215,{"date":334,"score":283,"percentile":335},"2026-04-30",0.42201,{"date":337,"score":283,"percentile":338},"2026-05-01",0.42195,{"date":340,"score":283,"percentile":341},"2026-05-02",0.42217,{"date":343,"score":283,"percentile":344},"2026-05-03",0.42154,{"date":346,"score":283,"percentile":347},"2026-05-04",0.42102,{"date":349,"score":283,"percentile":350},"2026-05-05",0.42071,{"date":352,"score":283,"percentile":353},"2026-05-06",0.42085,{"date":355,"score":283,"percentile":356},"2026-05-07",0.42145,{"date":358,"score":283,"percentile":359},"2026-05-08",0.42128,{"date":361,"score":283,"percentile":362},"2026-05-09",0.42161,{"date":364,"score":283,"percentile":365},"2026-05-10",0.42106,{"date":367,"score":283,"percentile":368},"2026-05-11",0.42076,{"date":370,"score":283,"percentile":371},"2026-05-12",0.42104,{"date":373,"score":283,"percentile":374},"2026-05-13",0.42141,{"date":376,"score":283,"percentile":377},"2026-05-14",0.42175,{"date":379,"score":283,"percentile":380},"2026-05-15",0.42186,{"date":382,"score":283,"percentile":383},"2026-05-16",0.42211,{"date":385,"score":283,"percentile":386},"2026-05-17",0.42203,{"date":388,"score":283,"percentile":389},"2026-05-18",0.42151,{"date":391,"score":392,"percentile":393},"2026-05-19",0.00175,0.38485,{"date":395,"score":392,"percentile":396},"2026-05-20",0.38493,{"date":398,"score":392,"percentile":399},"2026-05-21",0.38488,{"date":401,"score":392,"percentile":402},"2026-05-22",0.38533,{"date":404,"score":392,"percentile":405},"2026-05-23",0.38539,{"date":407,"score":392,"percentile":396},"2026-05-24",{"date":409,"score":392,"percentile":410},"2026-05-25",0.38465,{"date":412,"score":392,"percentile":413},"2026-05-26",0.3846,{"date":415,"score":392,"percentile":416},"2026-05-27",0.38517,{"date":418,"score":392,"percentile":419},"2026-05-28",0.38609,{"date":421,"score":392,"percentile":422},"2026-05-29",0.38648,{"date":424,"score":392,"percentile":425},"2026-05-30",0.38653,{"date":427,"score":392,"percentile":428},"2026-05-31",0.3863,{"date":430,"score":392,"percentile":431},"2026-06-01",0.38611,{"date":433,"score":392,"percentile":434},"2026-06-02",0.38628,{"date":436,"score":392,"percentile":437},"2026-06-03",0.38624,{"date":439,"score":392,"percentile":440},"2026-06-04",0.38635,{"date":442,"score":392,"percentile":443},"2026-06-05",0.38725,{"date":445,"score":392,"percentile":446},"2026-06-06",0.38728,{"date":448,"score":392,"percentile":449},"2026-06-07",0.38701,{"date":451,"score":392,"percentile":452},"2026-06-08",0.38673,{"date":454,"score":392,"percentile":455},"2026-06-09",0.38683,{"date":457,"score":392,"percentile":458},"2026-06-10",0.38717,[460,465,467],{"source":64,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":461,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":462,"vectorString":65,"impactScore":463,"exploitabilityScore":464},"HIGH",6,10,{"source":70,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":466,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":462,"vectorString":65,"impactScore":463,"exploitabilityScore":464},{"source":71,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":468,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":9,"vectorString":65,"impactScore":463,"exploitabilityScore":464},[470,486,495],{"ecosystem":9,"name":471,"vendor":472,"product":471,"cpe_part":473,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":474},"undici","nodejs","a",[475,481],{"version":476,"is_range":477,"range_type":478,"version_start":9,"version_start_type":9,"version_end":479,"version_end_type":480,"fixed_in":9},"lt6.24.0",true,"cpe","6.24.0","excluding",{"version":482,"is_range":477,"range_type":478,"version_start":483,"version_start_type":484,"version_end":485,"version_end_type":480,"fixed_in":9},"gte7.0.0_lt7.24.0","7.0.0","including","7.24.0",{"ecosystem":487,"name":471,"vendor":487,"product":471,"cpe_part":9,"purl_type":488,"purl_namespace":9,"purl_name":471,"source":9,"versions":489},"Npm","npm",[490,493],{"version":491,"is_range":477,"range_type":492,"version_start":9,"version_start_type":9,"version_end":479,"version_end_type":480,"fixed_in":9},"lt6_24_0","semver",{"version":494,"is_range":477,"range_type":492,"version_start":483,"version_start_type":484,"version_end":485,"version_end_type":480,"fixed_in":9},"gte7_0_0_lt7_24_0",{"ecosystem":9,"name":471,"vendor":471,"product":471,"cpe_part":473,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":496},[497],{"version":498,"is_range":477,"range_type":64,"version_start":9,"version_start_type":9,"version_end":499,"version_end_type":480,"fixed_in":9},"\u003C 6.24.0; 7.0.0 \u003C 7.24.0","6.24.0; 7.0.0 \u003C 7.24.0"]