Nodejs Undici vulnerabilities

• nodejs undici undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor CVE-2026-87029 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering CVE-2026-109932 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018 Fix available 7.5 HighOctober 15, 2026
• nodejs undici undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent CVE-2026-109383 Fix available 7.4 HighOctober 15, 2026
• nodejs undici undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects CVE-2026-109829 Fix available 7.4 HighOctober 15, 2026
• nodejs undici undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109841 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via unbounded memory in the EventSource parser CVE-2026-109924 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via unhandled error on excessive content-encodings CVE-2026-109869 Fix available 7.5 HighOctober 15, 2026
• nodejs undici undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake CVE-2026-109855 Fix available 7.5 HighOctober 10, 2026
• nodejs undici undici vulnerable to downstream response splitting via retry interceptor CVE-2026-18540 Fix available 3.7 LowSeptember 4, 2026
• nodejs undici undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534 Fix available 7.5 HighSeptember 4, 2026
• nodejs undici undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-84961 Fix available 7.4 HighSeptember 4, 2026
• nodejs undici undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-85024 Fix available 5.9 MediumSeptember 4, 2026
• nodejs undici undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152 Fix available 7.4 HighAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014 Fix available 5.9 MediumAugust 13, 2026
• nodejs undici undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85008 Fix available 3.7 LowAugust 13, 2026
• nodejs undici undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84947 Fix available 3.7 LowAugust 13, 2026
• nodejs undici undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933 Fix available 6.5 MediumAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84890 Fix available 5.9 MediumAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18149 Fix available 5.9 MediumAugust 13, 2026
• nodejs undici undici vulnerable to CRLF Injection via blob-like body 'type' property CVE-2026-15157 Fix available 4.2 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives CVE-2026-14643 Fix available 5.9 MediumJuly 29, 2026
• nodejs undici undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-16728 Fix available 4.8 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields CVE-2026-16729 Fix available 4.8 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives CVE-2026-13697 Fix available 7.4 HighJuly 29, 2026
• nodejs undici undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching CVE-2026-11525 Fix available 3.7 LowJune 17, 2026
• nodejs undici undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse CVE-2026-6733 Fix available 3.7 LowJune 17, 2026
• nodejs undici undici vulnerable to HTTP header injection via Set-Cookie percent-decoding CVE-2026-9679 Fix available 5.9 MediumJune 17, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 more undici WebSocket client vulnerable to denial of service via fragment count bypass CVE-2026-12151 Fix available 7.5 HighJune 17, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 more undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent CVE-2026-9697 Fix available 7.4 HighApril 21, 2026
• nodejs undici undici vulnerable to cross-user information disclosure via shared cache whitespace bypass CVE-2026-9678 Fix available 5.9 MediumApril 21, 2026
• nodejs undici undici WebSocket client vulnerable to denial of service via cumulative fragment bypass CVE-2026-9675 Fix available 7.5 HighApril 21, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 more undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse CVE-2026-6734 Fix available 7.5 HighApril 21, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 more undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-2229 Fix available 7.5 HighMarch 12, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +18 more +20 more undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client CVE-2026-1528 Fix available 7.5 HighMarch 12, 2026
• nodejs undici undici is vulnerable to CRLF Injection via upgrade option CVE-2026-1527 Fix available 4.6 MediumMarch 12, 2026
• nodejs undici undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS CVE-2026-2581 Fix available 5.9 MediumMarch 12, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 more undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression CVE-2026-1526 Fix available 7.5 HighMarch 12, 2026
• nodejs undici undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVE-2026-1525 Fix available 6.5 MediumMarch 12, 2026
• nodejs undici Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion CVE-2026-22036 Fix available 5.9 MediumJanuary 14, 2026
• nodejs undici undici Denial of Service attack via bad certificate data CVE-2025-47279 Fix available 3.1 LowMay 15, 2025
• nodejs undici Undici Uses Insufficiently Random Values CVE-2025-22150 Fix available 6.8 MediumJanuary 21, 2025
• nodejs undici Undici vulnerable to data leak when using response.arrayBuffer() CVE-2024-38372 Fix available 2.0 LowJuly 8, 2024
• nodejs undici, fedoraproject fedora +1 more Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect CVE-2024-30261 Fix available 2.6 LowApril 4, 2024
• nodejs undici, fedoraproject fedora +1 more Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline CVE-2024-30260 Fix available 3.9 LowApril 4, 2024
• nodejs undici Backpressure request ignored in fetch() in Undici CVE-2024-24750 Fix available 6.5 MediumFebruary 16, 2024
• nodejs undici Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici CVE-2024-24758 Fix available 3.9 LowFebruary 16, 2024
• nodejs undici, fedoraproject fedora +1 more Undici's cookie header not cleared on cross-origin redirect in fetch CVE-2023-45143 Fix available 3.9 LowOctober 12, 2023
• nodejs node.js, undici +1 more CRLF Injection in Nodejs ‘undici’ via host CVE-2023-23936 Fix available 6.5 MediumFebruary 16, 2023
• nodejs undici Undici vulnerable to Regular Expression Denial of Service in Headers CVE-2023-24807 Fix available 7.5 HighFebruary 16, 2023
• Show olderLoading…