Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Undici library used by Node apps can be abused
published 5 days ago
Summary
Several cleanstart packages (npm, qdrant, langfuse-worker, langfuse) rely on the Undici HTTP client for Node, which has a security weakness that could let an attacker interfere with web communication or execute unwanted actions. This could affect the reliability and safety of your services. Update the affected packages to the latest versions that include the fix, or switch to a different HTTP client if an update is not yet available.
What to do
- Update cleanstart npm to version 12.2.0-r3.
- Update cleanstart qdrant to version 1.19.2-r0.
- Update cleanstart langfuse-worker to version 3.225.9-r8.
- Update cleanstart npm to version 11.19.1-r2.
- Update cleanstart langfuse to version 3.225.9-r9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | npm |
< 12.2.0-r3 < 11.19.1-r2 Fix: upgrade to 12.2.0-r3
|
| CleanStart | cleanstart | qdrant |
< 1.19.2-r0 Fix: upgrade to 1.19.2-r0
|
| CleanStart | cleanstart | langfuse-worker |
< 3.225.9-r8 Fix: upgrade to 3.225.9-r8
|
| CleanStart | cleanstart | langfuse |
< 3.225.9-r9 Fix: upgrade to 3.225.9-r9
|
Original advisory text
undici is an HTTP client library for Node
CVE-2026-87018 affects multiple packages. undici is an HTTP client library for Node. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-RF21500 · OSV
Track software like this
Free during beta