What’s Vulnerable › Products
undici vulnerabilities
55 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 42 published in the last 12 months.
Check whether your undici version is affected
Latest undici vulnerabilities
- CVE-2026-87029 — undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor (CVSS 7.5)
- CVE-2026-87018 — undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation (CVSS 7.5)
- CVE-2026-109932 — undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering (CVSS 7.5)
- CVE-2026-109924 — undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (CVSS 7.5)
- CVE-2026-109869 — undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (CVSS 7.5)
- CVE-2026-109841 — undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens (CVSS 7.5)
- CVE-2026-109829 — undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects (CVSS 9.1)
- CVE-2026-109383 — undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent (CVSS 9.1)
- CVE-2026-109855 — undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake (CVSS 7.5)
- CVE-2026-84890 — undici vulnerable to Denial of Service via unbounded decompression of compressed responses (CVSS 5.9)
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (CVSS 7.5)
- CVE-2026-18540 — undici vulnerable to downstream response splitting via retry interceptor (CVSS 3.7)
- CVE-2026-18149 — undici vulnerable to Denial of Service via orphaned RetryHandler response body (CVSS 5.9)
- CVE-2026-85152 — undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors (CVSS 7.4)
- CVE-2026-85024 — undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression (CVSS 5.9)
- CVE-2026-85014 — undici vulnerable to Denial of Service via WebSocketStream unclean close (CVSS 7.5)
- CVE-2026-85008 — undici vulnerable to caching and replay of unsafe HTTP method responses (CVSS 5.3)
- CVE-2026-84961 — undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool (CVSS 9.1)
- CVE-2026-84947 — undici vulnerable to response truncation via oversized chunked responses in the dump interceptor (CVSS 5.3)
- CVE-2026-84933 — undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches (CVSS 8.2)
- CVE-2026-15157 — undici vulnerable to CRLF Injection via blob-like body 'type' property (CVSS 5.4)
- CVE-2026-14643 — undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (CVSS 7.5)
- CVE-2026-16728 — undici vulnerable to downstream response desynchronization via retry interceptor (CVSS 6.5)
- CVE-2026-16729 — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (CVSS 6.5)
- CVE-2026-13697 — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (CVSS 9.1)