Login Request a demo
UN
Product
Undici
by Nodejs · last CVE Oct 15, 2026
52
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Vulnerabilities52In the news0Timeline
Severity mix
Critical 6High 21Medium 20Low 5
Severity
All severities52Critical6High21Medium20Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Undici to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-18540
3.7
0%
Sep 4
undici vulnerable to downstream response splitting via retry interceptor
Affected: before 6.28.1; 7.0.0 before 7.29.1; 8.0.0 before 8.10.2
CVE-2026-11525
3.7
0%
Jun 17
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Affected: before 6.27.0; 7.0.0 before 7.28.0; 8.0.0 before 8.5.0
CVE-2026-6733
3.7
0%
Jun 17
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
Affected: before 6.27.0; 7.0.0 before 7.28.0; 8.0.0 before 8.5.0
CVE-2024-30261
3.5
1%
Apr 4
Undici is an HTTP/1.1 client, written from scratch for Node.js
Affected: before 5.28.4; 6.0.0 before 6.11.1
CVE-2023-45143
3.5
1%
Oct 12
Undici is an HTTP/1.1 client written from scratch for Node.js
Affected: before 5.26.2
Showing 5