Skip to main content
cve.nowby Sazabi
← npm
npmPackage

undici

54 known vulnerabilities (17 high, 24 medium, 12 low), with the versions each affects and the releases that fix them.

Latest release
8.12.4 (Nov 5, 2026): no advisory affects it
Newest unaffected release
8.12.4 (Nov 5, 2026), the latest release
Advisories
54 · 17 high, 24 medium, 12 low
Weekly downloads
308.5M
Dependents
11.8K
Releases
317 since 0.1.0 (Jul 26, 2018)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-109932
    Affects 5.15.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-87018
    Affects 4.2.1 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109383
    Affects 4.0.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109829
    Affects 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109841
    Affects 7.15.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109924
    Affects 6.5.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109869
    Affects 6.23.0 to 6.29.0 (6.29.1 is outside it); 7.18.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it)
  • CVE-2026-109855
    Affects 8.11.0 to 8.11.1 (8.11.2 is outside it)
  • CVE-2026-18149
    Affects 7.11.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-18540
    Affects 0.1.0 to 6.28.0 (6.28.1 is outside it); 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-19534
    Affects 6.7.0 to 6.28.0 (6.28.1 is outside it); 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-84890
    Affects 7.15.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
Show all 54 advisoriesShow fewer advisories
  • CVE-2026-84933
    Affects 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-84947
    Affects 7.1.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-84961
    Affects 7.24.1 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-85008
    Affects 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-85152
    Affects 8.10.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-85014
    Affects 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-85024
    Affects 6.25.0 to 6.28.0 (6.28.1 is outside it); 7.28.0 to 7.29.0 (7.29.1 is outside it); 8.1.0 to 8.10.1 (8.10.2 is outside it)
  • CVE-2026-15157
    Affects 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it)
  • CVE-2026-14643
    Affects 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it)
  • CVE-2026-16728
    Affects 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it)
  • CVE-2026-16729
    Affects 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it)
  • CVE-2026-13697
    Affects 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it)
  • CVE-2026-11525
    Affects 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-6733
    Affects 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-9678
    Affects 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-9679
    Affects 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-9697
    Affects 7.23.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-6734
    Affects 7.23.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.1.0 (8.2.0 is outside it)
  • CVE-2026-9675
    Affects 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-12151
    Affects 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it)
  • CVE-2026-2229
    Affects 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-1528
    Affects 6.0.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-1527
    Affects 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-2581
    Affects 7.17.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-1526
    Affects 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-1525
    Affects 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it)
  • CVE-2026-22036
    Affects 0.1.0 to 6.22.0 (6.23.0 is outside it); 7.0.0 to 7.18.1 (7.18.2 is outside it)
  • CVE-2025-47279
    Affects 0.1.0 to 5.28.5 (5.29.0 is outside it); 6.0.0 to 6.21.1 (6.21.2 is outside it); 7.0.0 to 7.4.0 (7.5.0 is outside it)
  • CVE-2025-22150
    Affects 4.5.0 to 5.28.4 (5.28.5 is outside it); 6.0.0 to 6.21.0 (6.21.1 is outside it); 7.0.0 to 7.2.2 (7.2.3 is outside it)
  • CVE-2024-38372
    Affects 6.14.0 to 6.19.1 (6.19.2 is outside it)
  • CVE-2024-30260
    Affects 0.1.0 to 5.28.3 (5.28.4 is outside it); 6.0.0 to 6.11.0 (6.11.1 is outside it)
  • CVE-2024-30261
    Affects 0.1.0 to 5.28.3 (5.28.4 is outside it); 6.0.0 to 6.11.0 (6.11.1 is outside it)
  • CVE-2024-24750
    Affects 6.0.0 to 6.6.0 (6.6.1 is outside it)
  • CVE-2024-24758
    Affects 0.1.0 to 5.28.2 (5.28.3 is outside it); 6.0.0 to 6.6.0 (6.6.1 is outside it)
  • CVE-2023-45143
    Affects 0.1.0 to 5.26.1 (5.26.2 is outside it)
  • CVE-2023-23936
    Affects 2.0.0 to 5.19.0 (5.19.1 is outside it)
  • CVE-2023-24807
    Affects 0.1.0 to 5.19.0 (5.19.1 is outside it)
  • CVE-2022-35948
    Affects 0.1.0 to 5.8.1 (5.8.2 is outside it)
  • CVE-2022-35949
    Affects 0.1.0 to 5.8.1 (5.8.2 is outside it)
  • CVE-2022-31151
    Affects 0.1.0 to 5.7.0 (5.8.0 is outside it)
  • CVE-2022-31150
    Affects 0.1.0 to 5.7.0 (5.8.0 is outside it)
  • CVE-2022-32210
    Affects 4.8.2 to 5.5.0 (5.5.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 54

  • CVE-2026-109932Medium 5.9

    undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

    Affected: from 5.15.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    56% of undici downloads last week were affected versions (188.4M).

  • undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    Affected: from 4.2.1, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    56% of undici downloads last week were affected versions (189.2M).

  • undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    Affected: from 4.0.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    56% of undici downloads last week were affected versions (189.2M).

  • undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    Affected: from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    35% of undici downloads last week were affected versions (116M).

  • CVE-2026-109841Medium 5.9

    undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

    Affected: from 7.15.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    34% of undici downloads last week were affected versions (113.5M).

  • CVE-2026-109924Medium 5.9

    undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

    Affected: from 6.5.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    47% of undici downloads last week were affected versions (156.9M).

  • undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    Affected: from 6.23.0, fixed in 6.29.1; from 7.18.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2.

    Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    43% of undici downloads last week were affected versions (144M).

  • undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

    Affected: from 8.11.0, fixed in 8.11.2.

    Fixed in 8.11.2 (released Sep 24, 2026, 21 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.2% of undici downloads last week were affected versions (544.5K).

  • CVE-2026-18149Medium 5.9

    undici vulnerable to Denial of Service via orphaned RetryHandler response body

    Affected: from 7.11.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    20% of undici downloads last week were affected versions (67.1M).

  • undici vulnerable to downstream response splitting via retry interceptor

    Affected: fixed in 6.28.1; from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    38% of undici downloads last week were affected versions (128.2M).

  • undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    Affected: from 6.7.0, fixed in 6.28.1; from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    29% of undici downloads last week were affected versions (95.8M).

  • CVE-2026-84890Medium 5.9

    undici vulnerable to Denial of Service via unbounded decompression of compressed responses

    Affected: from 7.15.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    19% of undici downloads last week were affected versions (65.3M).

  • CVE-2026-84933Medium 6.5

    undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

    Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    20% of undici downloads last week were affected versions (67.8M).

  • undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

    Affected: from 7.1.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    20% of undici downloads last week were affected versions (67.8M).

  • undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

    Affected: from 7.24.1, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    17% of undici downloads last week were affected versions (58.5M).

Show all 54 advisoriesShow fewer advisories

  • undici vulnerable to caching and replay of unsafe HTTP method responses

    Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    20% of undici downloads last week were affected versions (67.8M).

  • undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

    Affected: from 8.10.0, fixed in 8.10.2.

    Fixed in 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    1.4% of undici downloads last week were affected versions (4.7M).

  • CVE-2026-85014Medium 5.9

    undici vulnerable to Denial of Service via WebSocketStream unclean close

    Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2.

    Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    20% of undici downloads last week were affected versions (67.8M).

  • CVE-2026-85024Medium 5.9

    undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

    Affected: from 6.25.0, fixed in 6.28.1; from 7.28.0, fixed in 7.29.1; from 8.1.0, fixed in 8.10.2.

    Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    17% of undici downloads last week were affected versions (57.4M).

  • CVE-2026-15157Medium 4.2

    undici vulnerable to CRLF Injection via blob-like body 'type' property

    Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0.

    Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    28% of undici downloads last week were affected versions (95.6M).

  • CVE-2026-14643Medium 5.9

    undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

    Affected: from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0.

    Fixed in 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    12% of undici downloads last week were affected versions (41.6M).

  • CVE-2026-16728Medium 4.8

    undici vulnerable to downstream response desynchronization via retry interceptor

    Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0.

    Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    28% of undici downloads last week were affected versions (95.6M).

  • CVE-2026-16729Medium 4.8

    undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

    Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0.

    Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    28% of undici downloads last week were affected versions (95.6M).

  • undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

    Affected: from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0.

    Fixed in 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    12% of undici downloads last week were affected versions (41.6M).

  • undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

    Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    23% of undici downloads last week were affected versions (75.8M).

  • undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

    Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    23% of undici downloads last week were affected versions (75.8M).

  • CVE-2026-9678Medium 5.9

    undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

    Affected: from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    7.7% of undici downloads last week were affected versions (25.9M).

  • CVE-2026-9679Medium 5.9

    undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

    Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    23% of undici downloads last week were affected versions (75.8M).

  • undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

    Affected: from 7.23.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    5% of undici downloads last week were affected versions (16.8M).

  • undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

    Affected: from 7.23.0, fixed in 7.28.0; from 8.0.0, fixed in 8.2.0.

    Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.2.0 (released May 1, 2026, 47 days before disclosure).

    The latest release, 8.12.4, is not affected.

    4.8% of undici downloads last week were affected versions (16.3M).

  • undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

    Affected: from 8.0.0, fixed in 8.5.0.

    Fixed in 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.2% of undici downloads last week were affected versions (688.8K).

  • undici WebSocket client vulnerable to denial of service via fragment count bypass

    Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0.

    Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    23% of undici downloads last week were affected versions (75.8M).

  • undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

    Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0.

    Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    15% of undici downloads last week were affected versions (50.8M).

  • undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

    Affected: from 6.0.0, fixed in 6.24.0; from 7.0.0, fixed in 7.24.0.

    Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    5.5% of undici downloads last week were affected versions (18.4M).

  • CVE-2026-1527Medium 4.6

    undici is vulnerable to CRLF Injection via upgrade option

    Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0.

    Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    15% of undici downloads last week were affected versions (50.8M).

  • CVE-2026-2581Medium 5.9

    undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

    Affected: from 7.17.0, fixed in 7.24.0.

    Fixed in 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    1% of undici downloads last week were affected versions (3.4M).

  • undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

    Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0.

    Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    15% of undici downloads last week were affected versions (50.8M).

  • CVE-2026-1525Medium 6.5

    undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0.

    Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 8.12.4, is not affected.

    15% of undici downloads last week were affected versions (50.8M).

  • CVE-2026-22036Medium 5.9

    Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

    Affected: from 7.0.0, fixed in 7.18.2; fixed in 6.23.0.

    Fixed in 6.23.0 (released Jan 5, 2026, 9 days before disclosure) and 7.18.2 (released Jan 6, 2026, 8 days before disclosure).

    The latest release, 8.12.4, is not affected.

    13% of undici downloads last week were affected versions (45.2M).

  • undici Denial of Service attack via bad certificate data

    Affected: fixed in 5.29.0; from 6.0.0, fixed in 6.21.2; from 7.0.0, fixed in 7.5.0.

    Fixed in 5.29.0 (released Mar 19, 2025, 57 days before disclosure), 6.21.2 (released Mar 13, 2025, 63 days before disclosure) and 7.5.0 (released Mar 12, 2025, 64 days before disclosure).

    The latest release, 8.12.4, is not affected.

    4.2% of undici downloads last week were affected versions (14.1M).

  • CVE-2025-22150Medium 6.8

    Undici Uses Insufficiently Random Values

    Affected: from 4.5.0, fixed in 5.28.5; from 6.0.0, fixed in 6.21.1; from 7.0.0, fixed in 7.2.3.

    Fixed in 5.28.5 (released Jan 16, 2025, 5 days before disclosure), 6.21.1 (released Jan 16, 2025, 5 days before disclosure) and 7.2.3 (released Jan 16, 2025, 5 days before disclosure).

    The latest release, 8.12.4, is not affected.

    3.8% of undici downloads last week were affected versions (12.8M).

  • Undici vulnerable to data leak when using response.arrayBuffer()

    Affected: from 6.14.0, fixed in 6.19.2.

    Fixed in 6.19.2 (released Jun 18, 2024, 20 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (110.4K).

  • Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

    Affected: fixed in 5.28.4; from 6.0.0, fixed in 6.11.1.

    Fixed in 5.28.4 (released Apr 2, 2024, 2 days before disclosure) and 6.11.1 (released Apr 2, 2024, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.9% of undici downloads last week were affected versions (3M).

  • Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

    Affected: fixed in 5.28.4; from 6.0.0, fixed in 6.11.1.

    Fixed in 5.28.4 (released Apr 2, 2024, 2 days before disclosure) and 6.11.1 (released Apr 2, 2024, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.9% of undici downloads last week were affected versions (3M).

  • CVE-2024-24750Medium 6.5

    Backpressure request ignored in fetch() in Undici

    Affected: from 6.0.0, fixed in 6.6.1.

    Fixed in 6.6.1 (released Feb 5, 2024, 11 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (22.4K).

  • Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

    Affected: fixed in 5.28.3; from 6.0.0, fixed in 6.6.1.

    Fixed in 5.28.3 (released Feb 5, 2024, 11 days before disclosure) and 6.6.1 (released Feb 5, 2024, 11 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.8% of undici downloads last week were affected versions (2.5M).

  • Undici's cookie header not cleared on cross-origin redirect in fetch

    Affected: fixed in 5.26.2.

    Fixed in 5.26.2 (released Oct 11, 2023, 1 day before disclosure).

    The latest release, 8.12.4, is not affected.

    0.4% of undici downloads last week were affected versions (1.3M).

  • CVE-2023-23936Medium 6.5

    CRLF Injection in Nodejs ‘undici’ via host

    Affected: from 2.0.0, fixed in 5.19.1.

    Fixed in 5.19.1 (released Feb 13, 2023, 3 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.2% of undici downloads last week were affected versions (782.6K).

  • Undici vulnerable to Regular Expression Denial of Service in Headers

    Affected: fixed in 5.19.1.

    Fixed in 5.19.1 (released Feb 13, 2023, 3 days before disclosure).

    The latest release, 8.12.4, is not affected.

    0.2% of undici downloads last week were affected versions (784.6K).

  • CVE-2022-35948Medium 5.3

    CRLF Injection in Nodejs ‘undici’ via Content-Type

    Affected: fixed in 5.8.2.

    Fixed in 5.8.2 (released Aug 9, 2022, 4 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (301.1K).

  • CVE-2022-35949Medium 5.3

    `undici.request` vulnerable to SSRF using absolute URL on `pathname`

    Affected: fixed in 5.8.2.

    Fixed in 5.8.2 (released Aug 9, 2022, 3 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (301.1K).

  • Uncleared cookies on cross-host/cross-origin redirect in undici

    Affected: fixed in 5.8.0.

    Fixed in 5.8.0 (released Jul 18, 2022, 2 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (271.8K).

  • CVE-2022-31150Medium 5.3

    CRLF injection in request headers

    Affected: fixed in 5.8.0.

    Fixed in 5.8.0 (released Jul 18, 2022, 1 day before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (271.8K).

  • `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy.

    Affected: from 4.8.2, fixed in 5.5.1.

    Fixed in 5.5.1 (released Jun 13, 2022, 31 days before disclosure).

    The latest release, 8.12.4, is not affected.

    <0.1% of undici downloads last week were affected versions (153.9K).