[ Vendor · 20 CVEs ]
undici
CVEs affecting undici published in the last 30 days, plus any undici CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-87029 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards… | |
| CVE-2026-87018 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process… | |
| CVE-2026-109924 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource… | |
| CVE-2026-109932 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket… | |
| CVE-2026-109829 | 15 Oct 2026 | CVSS 9.1 | undiciundici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the… | |
| CVE-2026-109841 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies… | |
| CVE-2026-109869 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch()… | |
| CVE-2026-109383 | 15 Oct 2026 | CVSS 9.1 | undiciundici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher… | |
| CVE-2026-109855 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when… | |
| CVE-2026-18149 | 4 Sep 2026 | CVSS 5.9 | undici vulnerable to Denial of Service via orphaned RetryHandler response bodyundici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a… | Fix |
| CVE-2026-18540 | 4 Sep 2026 | CVSS 3.7 | undici vulnerable to downstream response splitting via retry interceptorundici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still… | Fix |
| CVE-2026-19534 | 4 Sep 2026 | CVSS 7.5 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocolundici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client… | Fix |
| CVE-2026-84890 | 4 Sep 2026 | CVSS 5.9 | undici vulnerable to Denial of Service via unbounded decompression of compressed responsesundici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding… | Fix |
| CVE-2026-84933 | 4 Sep 2026 | CVSS 6.5 | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesundici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that… | Fix |
| CVE-2026-84947 | 4 Sep 2026 | CVSS 3.7 | undici vulnerable to response truncation via oversized chunked responses in the dump interceptorundici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that… | Fix |
| CVE-2026-84961 | 4 Sep 2026 | CVSS 7.4 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolundici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON… | Fix |
| CVE-2026-85008 | 4 Sep 2026 | CVSS 3.7 | undici vulnerable to caching and replay of unsafe HTTP method responsesundici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured… | Fix |
| CVE-2026-85152 | 4 Sep 2026 | CVSS 7.4 | undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsundici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed… | Fix |
| CVE-2026-85014 | 4 Sep 2026 | CVSS 5.9 | undici vulnerable to Denial of Service via WebSocketStream unclean closeundici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close… | Fix |
| CVE-2026-85024 | 4 Sep 2026 | CVSS 5.9 | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionundici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including… | Fix |