UN
Product
undici
39
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 5High 19Medium 12Low 3
Watch
Add undici to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6734 | 8.8 | Jun 17 | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse Affected: 7.23.0 before 7.26.0; 8.0.0 before 8.2.0 |
| CVE-2026-84933 | 8.2 | Sep 4 | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches Affected: 7.0.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-87029 | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor Affected: 7.15.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109932 | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Affected: 5.15.0 before 6.29.1; 7.0.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-87018 | 7.5 | Oct 15 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation Affected: 4.2.1 before 6.29.1; 7.0.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109841 | 7.5 | Oct 15 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens Affected: 7.15.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109924 | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser Affected: 6.5.0 before 6.29.1; 7.0.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109869 | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings Affected: 6.23.0 before 6.29.1; 7.18.0 before 7.30.1; 8.0.0 before 8.12.2 |
| CVE-2026-109855 | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake Affected: 8.11.0 before 8.11.2 |
| CVE-2026-19534 | 7.5 | Sep 4 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol Affected: 6.7.0 before 6.28.1; 7.0.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-85014 | 7.5 | Sep 4 | undici vulnerable to Denial of Service via WebSocketStream unclean close Affected: 7.0.0 before 7.29.1; 8.0.0 before 8.10.2 |
| CVE-2026-14643 | 7.5 | Jul 29 | undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives Affected: 7.0.0 before 7.29.0; 8.0.0 before 8.9.0 |
| CVE-2026-9675 | 7.5 | Jun 17 | undici WebSocket client vulnerable to denial of service via cumulative fragment bypass Affected: 8.0.0 before 8.5.0 |
| CVE-2026-12151 | 7.5 | Jun 17 | undici WebSocket client vulnerable to denial of service via fragment count bypass Affected: before 6.26.0; 7.0.0 before 7.28.0; 8.0.0 before 8.5.0 |
| CVE-2026-2229 | 7.5 | Mar 12 | undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation Affected: < 6.24.0; 7.0.0 < 7.24.0 |
| CVE-2026-1528 | 7.5 | Mar 12 | undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client Affected: >= 6.0.0 < 6.24.0; 7.0.0 < 7.24.0 |
| CVE-2026-1526 | 7.5 | Mar 12 | undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression Affected: < 6.24.0; 7.0.0 < 7.24.0 |
| CVE-2026-85152 | 7.4 | Sep 4 | undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors Affected: 8.10.0 before 8.10.2 |
| CVE-2026-9697 | 7.4 | Jun 17 | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent Affected: 7.23.0 before 7.28.0; 8.0.0 before 8.5.0 |
Showing 19
