UN
Product
undici
39
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 5High 19Medium 12Low 3
Watch
Add undici to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1525 | 9.8 | Mar 12 | undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected: < 6.24.0; 7.0.0 < 7.24.0 |
| CVE-2026-109383 | 9.1 | Oct 15 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent Affected: 4.0.0 before 6.29.1; 7.0.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109829 | 9.1 | Oct 15 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects Affected: 7.0.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-84961 | 9.1 | Sep 4 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool Affected: 7.24.1 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-13697 | 9.1 | Jul 29 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives Affected: 7.0.0 before 7.29.0; 8.0.0 before 8.9.0 |
Showing 5