UN
Product
undici
52
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 6High 21Medium 20Low 5
Watch
Add undici to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16728 | 6.5 | Jul 29 | undici vulnerable to downstream response desynchronization via retry interceptor Affected: before 6.28.0; 7.0.0 before 7.29.0; 8.0.0 before 8.9.0 |
| CVE-2026-16729 | 6.5 | Jul 29 | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields Affected: before 6.28.0; 7.0.0 before 7.29.0; 8.0.0 before 8.9.0 |
| CVE-2024-24750 | 6.5 | Feb 16 | Undici is an HTTP/1.1 client, written from scratch for Node.js Affected: 6.0.0 before 6.6.1 |
| CVE-2022-31151 | 6.5 | Jul 21 | Authorization headers are cleared on cross-origin redirect Affected: before 5.7.1 |
| CVE-2022-31150 | 6.5 | Jul 19 | undici is an HTTP/1.1 client, written from scratch for Node.js Affected: before 5.8.0 |
| CVE-2022-32210 | 6.5 | Jul 14 | `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy Affected: 4.8.2 before 5.5.1 |
| CVE-2026-18149 | 5.9 | Sep 4 | undici vulnerable to Denial of Service via orphaned RetryHandler response body Affected: 7.11.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-84890 | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unbounded decompression of compressed responses Affected: 7.15.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-85024 | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression Affected: 6.25.0 before 6.28.1; 7.28.0 before 7.29.1; 8.1.0 before 8.10.2 |
| CVE-2026-9678 | 5.9 | Jun 17 | undici vulnerable to cross-user information disclosure via shared cache whitespace bypass Affected: 7.0.0 before 7.28.0; 8.0.0 before 8.5.0 |
| CVE-2026-9679 | 5.9 | Jun 17 | undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Affected: before 6.27.0; 7.0.0 before 7.28.0; 8.0.0 before 8.5.0 |
| CVE-2026-2581 | 5.9 | Mar 12 | undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS Affected: 7.17.0 before 7.24.0 |
| CVE-2026-15157 | 5.4 | Jul 29 | undici vulnerable to CRLF Injection via blob-like body 'type' property Affected: before 6.28.0; 7.0.0 before 7.29.0; 8.0.0 before 8.9.0 |
| CVE-2023-23936 | 5.4 | Feb 16 | Undici is an HTTP/1.1 client for Node.js Affected: 2.0.0 before 5.19.1 |
| CVE-2026-84947 | 5.3 | Sep 4 | undici vulnerable to response truncation via oversized chunked responses in the dump interceptor Affected: 7.1.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-85008 | 5.3 | Sep 4 | undici vulnerable to caching and replay of unsafe HTTP method responses Affected: 7.0.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2022-35948 | 5.3 | Aug 15 | undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request… Affected: before 5.8.2 |
| CVE-2026-1527 | 4.6 | Mar 12 | undici is vulnerable to CRLF Injection via upgrade option Affected: before 6.24.0; 7.0.0 before 7.24.0 |
| CVE-2024-24758 | 4.5 | Feb 16 | Undici is an HTTP/1.1 client, written from scratch for Node.js Affected: before 5.28.3; 6.0.0 before 6.6.1 |
| CVE-2024-30260 | 4.3 | Apr 4 | Undici is an HTTP/1.1 client, written from scratch for Node.js Affected: before 5.28.4; 6.0.0 before 6.11.1 |
Showing 20