{"metadata": {"vulnerability": "CVE-2026-109869", "count": 60, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 53}}, "data": [{"timestamp": "2026-09-28T20:50:59.984Z", "date_only": false, "value": "2026-09-28T20:50:59.984000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-09-28T21:02:20.910Z", "date_only": false, "value": "2026-09-28T21:02:20.910434+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-13T08:52:10.454Z", "date_only": false, "value": "2026-10-13T08:52:10.454Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109869", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T18:08:31.243Z", "date_only": false, "value": "2026-10-15T18:08:31.243Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109869", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T18:08:31.243Z", "date_only": false, "value": "2026-10-15T18:08:31.243000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-10-15T18:08:31.243Z", "date_only": false, "value": "2026-10-15T18:08:31.243000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-10-15T18:08:31.243Z", "date_only": false, "value": "2026-10-15T18:08:31.243Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-109869", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:16:48.452Z", "date_only": false, "value": "2026-10-15T18:16:48.452000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-10-15T18:16:48.452Z", "date_only": false, "value": "2026-10-15T18:16:48.452000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-10-15T18:22:06.283Z", "date_only": false, "value": "2026-10-15T18:22:06.283000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-10-15T18:22:06.283Z", "date_only": false, "value": "2026-10-15T18:22:06.283000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-10-15T18:26:58.737Z", "date_only": false, "value": "2026-10-15T18:26:58.737075Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117446332734779459", "record": "CVE-2026-109869", "field": "creation_timestamp", "uuid": "83a6ff8c-c2fa-47ff-85b9-8773aa19a926", "content": "CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109869https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929chttps://cna.openjsf.org/security-advisories.html#undici#CVE_2026_109869#bot", "url": "https://infosec.exchange/users/cve/statuses/117446332734779459"}, {"timestamp": "2026-10-15T18:28:04.954Z", "date_only": false, "value": "2026-10-15T18:28:04.954000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-10-15T18:28:04.954Z", "date_only": false, "value": "2026-10-15T18:28:04.954000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-10-15T18:31:39.700Z", "date_only": false, "value": "2026-10-15T18:31:39.700754+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-10-15T18:31:39.700Z", "date_only": false, "value": "2026-10-15T18:31:39.700754+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-10-15T18:34:01.468Z", "date_only": false, "value": "2026-10-15T18:34:01.468000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-10-15T18:34:01.468Z", "date_only": false, "value": "2026-10-15T18:34:01.468000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-10-15T18:34:33.100Z", "date_only": false, "value": "2026-10-15T18:34:33.100871+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-10-15T18:34:33.100Z", "date_only": false, "value": "2026-10-15T18:34:33.100871+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-10-15T18:38:25.613Z", "date_only": false, "value": "2026-10-15T18:38:25.613000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-15T18:38:25.613Z", "date_only": false, "value": "2026-10-15T18:38:25.613000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-15T18:42:19.338Z", "date_only": false, "value": "2026-10-15T18:42:19.338403+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-10-15T18:42:19.338Z", "date_only": false, "value": "2026-10-15T18:42:19.338403+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-10-15T18:44:22.571Z", "date_only": false, "value": "2026-10-15T18:44:22.571000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-10-15T18:44:22.571Z", "date_only": false, "value": "2026-10-15T18:44:22.571000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-10-15T18:45:26.683Z", "date_only": false, "value": "2026-10-15T18:45:26.683580+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-15T18:45:26.683Z", "date_only": false, "value": "2026-10-15T18:45:26.683580+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-15T18:45:43.553Z", "date_only": false, "value": "2026-10-15T18:45:43.553803+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-10-15T18:45:43.553Z", "date_only": false, "value": "2026-10-15T18:45:43.553803+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-15T18:45:59.990Z", "date_only": false, "value": "2026-10-15T18:45:59.990034+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-10-15T18:45:59.990Z", "date_only": false, "value": "2026-10-15T18:45:59.990034+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-10-15T18:48:36.902Z", "date_only": false, "value": "2026-10-15T18:48:36.902000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-15T18:48:36.902Z", "date_only": false, "value": "2026-10-15T18:48:36.902000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-15T19:02:19.103Z", "date_only": false, "value": "2026-10-15T19:02:19.103535+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-10-15T19:02:19.103Z", "date_only": false, "value": "2026-10-15T19:02:19.103535+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-10-15T19:17:21.770Z", "date_only": false, "value": "2026-10-15T19:17:21.770", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109869", "record": "FKIE_CVE-2026-109869", "field": "published"}, {"timestamp": "2026-10-15T19:23:21.481Z", "date_only": false, "value": "2026-10-15T19:23:21.481772+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-15T19:23:21.481Z", "date_only": false, "value": "2026-10-15T19:23:21.481772+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-109869", "record": "UBUNTU-CVE-2026-109869", "field": "published"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-109869", "record": "UBUNTU-CVE-2026-109869", "field": "modified"}, {"timestamp": "2026-10-16T20:05:44.033Z", "date_only": false, "value": "2026-10-16T20:05:44.033842Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109869", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T20:05:44.033Z", "date_only": false, "value": "2026-10-16T20:05:44.033842Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109869", "record": "FKIE_CVE-2026-109869", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T20:06:00.782Z", "date_only": false, "value": "2026-10-16T20:06:00.782Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109869", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:06:00.782Z", "date_only": false, "value": "2026-10-16T20:06:00.782Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109869", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:17:23.710Z", "date_only": false, "value": "2026-10-16T21:17:23.710", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109869", "record": "FKIE_CVE-2026-109869", "field": "lastModified"}, {"timestamp": "2026-10-19T04:50:55Z", "date_only": false, "value": "2026-10-19T04:50:55+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-19T04:50:55Z", "date_only": false, "value": "2026-10-19T04:50:55+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-19T04:50:55Z", "date_only": false, "value": "2026-10-19T04:50:55+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-19T04:53:47Z", "date_only": false, "value": "2026-10-19T04:53:47+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-19T07:29:32Z", "date_only": false, "value": "2026-10-19T07:29:32+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-19T07:29:32Z", "date_only": false, "value": "2026-10-19T07:29:32+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-19T07:29:32Z", "date_only": false, "value": "2026-10-19T07:29:32+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-19T07:32:21Z", "date_only": false, "value": "2026-10-19T07:32:21+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-19T11:40:40Z", "date_only": false, "value": "2026-10-19T11:40:40+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T11:40:40Z", "date_only": false, "value": "2026-10-19T11:40:40+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T11:40:40Z", "date_only": false, "value": "2026-10-19T11:40:40+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:84657", "record": "RHSA-2026:84657", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-19T11:40:42Z", "date_only": false, "value": "2026-10-19T11:40:42+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T11:40:42Z", "date_only": false, "value": "2026-10-19T11:40:42+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T11:40:42Z", "date_only": false, "value": "2026-10-19T11:40:42+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:84706", "record": "RHSA-2026:84706", "field": "document.tracking.current_release_date"}]}