UN
Vendor
undici
39
CVEs
0
On KEV
9
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87029 | UN undici undici | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
| CVE-2026-109932 | UN undici undici | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
| CVE-2026-87018 | UN undici undici | 7.5 | Oct 15 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
| CVE-2026-109383 | UN undici undici | 9.1 | Oct 15 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| CVE-2026-109829 | UN undici undici | 9.1 | Oct 15 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| CVE-2026-109841 | UN undici undici | 7.5 | Oct 15 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| CVE-2026-109924 | UN undici undici | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| CVE-2026-109869 | UN undici undici | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| CVE-2026-109855 | UN undici undici | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake |
| CVE-2026-18149 | UN undici undici | 5.9 | Sep 4 | undici vulnerable to Denial of Service via orphaned RetryHandler response body |
| CVE-2026-18540 | UN undici undici | 3.7 | Sep 4 | undici vulnerable to downstream response splitting via retry interceptor |
| CVE-2026-19534 | UN undici undici | 7.5 | Sep 4 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| CVE-2026-84890 | UN undici undici | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
| CVE-2026-84933 | UN undici undici | 8.2 | Sep 4 | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
| CVE-2026-84947 | UN undici undici | 5.3 | Sep 4 | undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
| CVE-2026-84961 | UN undici undici | 9.1 | Sep 4 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
| CVE-2026-85008 | UN undici undici | 5.3 | Sep 4 | undici vulnerable to caching and replay of unsafe HTTP method responses |
| CVE-2026-85152 | UN undici undici | 7.4 | Sep 4 | undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors |
| CVE-2026-85014 | UN undici undici | 7.5 | Sep 4 | undici vulnerable to Denial of Service via WebSocketStream unclean close |
| CVE-2026-85024 | UN undici undici | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
| CVE-2026-15157 | UN undici undici | 5.4 | Jul 29 | undici vulnerable to CRLF Injection via blob-like body 'type' property |
| CVE-2026-14643 | UN undici undici | 7.5 | Jul 29 | undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
| CVE-2026-16728 | UN undici undici | 6.5 | Jul 29 | undici vulnerable to downstream response desynchronization via retry interceptor |
| CVE-2026-16729 | UN undici undici | 6.5 | Jul 29 | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
| CVE-2026-13697 | UN undici undici | 9.1 | Jul 29 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| CVE-2026-11525 | UN undici undici | 3.7 | Jun 17 | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
| CVE-2026-6733 | UN undici undici | 3.7 | Jun 17 | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
| CVE-2026-9678 | UN undici undici | 5.9 | Jun 17 | undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
| CVE-2026-9679 | UN undici undici | 5.9 | Jun 17 | undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
| CVE-2026-9697 | UN undici undici | 7.4 | Jun 17 | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
| CVE-2026-6734 | UN undici undici | 8.8 | Jun 17 | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
| CVE-2026-9675 | UN undici undici | 7.5 | Jun 17 | undici WebSocket client vulnerable to denial of service via cumulative fragment bypass |
| CVE-2026-12151 | UN undici undici | 7.5 | Jun 17 | undici WebSocket client vulnerable to denial of service via fragment count bypass |
| CVE-2026-2229 | UN undici undici | 7.5 | Mar 12 | undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation |
| CVE-2026-1528 | UN undici undici | 7.5 | Mar 12 | undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client |
| CVE-2026-1527 | UN undici undici | 4.6 | Mar 12 | undici is vulnerable to CRLF Injection via upgrade option |
| CVE-2026-2581 | UN undici undici | 5.9 | Mar 12 | undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS |
| CVE-2026-1526 | UN undici undici | 7.5 | Mar 12 | undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression |
| CVE-2026-1525 | UN undici undici | 9.8 | Mar 12 | undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |