Latest vulnerabilities for "npm/undici"

npm/undiciImpact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2490024

npm/undiciImpact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sock…

Risk 5

Severity

1

First published (updated )

REDHAT-BUG-2490006

npm/undiciImpact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstr…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2490000

npm/undiciundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Risk 20

Severity

3.7

First published (updated )

CVE-2026-11525

npm/undiciundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Risk 20

Severity

3.7

First published (updated )

CVE-2026-6733

npm/undiciundici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Risk 26

Severity

5.9

EPSS

0.36%

First published (updated )

CVE-2026-9678

npm/undiciImpact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragment…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2489980

npm/undiciundici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Risk 26

Severity

5.9

EPSS

0.26%

First published (updated )

CVE-2026-9679

npm/undiciundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Risk 41

Severity

7.4

EPSS

0.46%

First published (updated )

CVE-2026-9697

npm/undiciundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Risk 79

Severity

8.8

First published (updated )

CVE-2026-6734

npm/undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Risk 31

Severity

7.5

EPSS

0.43%

First published (updated )

CVE-2026-9675

npm/undiciundici WebSocket client vulnerable to denial of service via fragment count bypass

Risk 43

Severity

7.5

First published (updated )

CVE-2026-12151

oss-secNodeJS Security leases fixes High, 5 Medium, 2 Low severity issues

First published (updated )

https://seclists.org/oss-sec/2026/q1/379

npm/undiciImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large …

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2447145

npm/undiciThe undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consump…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2447142

npm/undiciUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-var…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2447144

npm/undiciImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper valida…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2447143

npm/undiciThis is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Serv…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2447140

npm/undiciImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2447141

npm/undiciundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Risk 43

Severity

7.5

First published (updated )

CVE-2026-2229

npm/undiciundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

Risk 43

Severity

7.5

First published (updated )

CVE-2026-1528

npm/undiciundici is vulnerable to CRLF Injection via upgrade option

Risk 30

Severity

4.6

First published (updated )

CVE-2026-1527

npm/undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

Risk 35

Severity

5.9

First published (updated )

CVE-2026-2581

npm/undiciundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Risk 43

Severity

7.5

First published (updated )

CVE-2026-1526

npm/undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Risk 86

Severity

9.8

First published (updated )

CVE-2026-1525

npm/undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Risk 31

Severity

7.5

EPSS

0.02%

First published (updated )

CVE-2026-22036

Trending

npm/undiciImpact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins…

npm/undiciImpact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sock…

npm/undiciImpact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstr…

npm/undiciundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

npm/undiciundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Don't miss critical vulnerabilities

npm/undiciundici vulnerable to cross-user information disclosure via shared cache whitespace bypass

npm/undiciImpact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragment…

npm/undiciundici vulnerable to HTTP header injection via Set-Cookie percent-decoding

npm/undiciundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

npm/undiciundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Don't miss critical vulnerabilities

npm/undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass

npm/undiciundici WebSocket client vulnerable to denial of service via fragment count bypass

oss-secNodeJS Security leases fixes High, 5 Medium, 2 Low severity issues

npm/undiciImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large …

npm/undiciThe undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consump…

Don't miss critical vulnerabilities

npm/undiciUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-var…

npm/undiciImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper valida…

npm/undiciThis is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Serv…

npm/undiciImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an…

npm/undiciundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Don't miss critical vulnerabilities

npm/undiciundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

npm/undiciundici is vulnerable to CRLF Injection via upgrade option

npm/undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

npm/undiciundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

npm/undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Don't miss critical vulnerabilities

npm/undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Company

Resources

Contact