# undici (npm) vulnerabilities 54 known vulnerabilities (17 high, 24 medium, 12 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.12.4 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 8.12.4 (Nov 5, 2026), the latest release - Weekly downloads: 308.5M - Dependents: 11.8K - Releases: 317 since 0.1.0 (Jul 26, 2018) - Registry: https://www.npmjs.com/package/undici - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-109932: 5.15.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-87018: 4.2.1 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109383: 4.0.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109829: 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109841: 7.15.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109924: 6.5.0 to 6.29.0 (6.29.1 is outside it); 7.0.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109869: 6.23.0 to 6.29.0 (6.29.1 is outside it); 7.18.0 to 7.30.0 (7.30.1 is outside it); 8.0.0 to 8.12.1 (8.12.2 is outside it) - CVE-2026-109855: 8.11.0 to 8.11.1 (8.11.2 is outside it) - CVE-2026-18149: 7.11.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-18540: 0.1.0 to 6.28.0 (6.28.1 is outside it); 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-19534: 6.7.0 to 6.28.0 (6.28.1 is outside it); 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-84890: 7.15.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-84933: 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-84947: 7.1.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-84961: 7.24.1 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-85008: 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-85152: 8.10.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-85014: 7.0.0 to 7.29.0 (7.29.1 is outside it); 8.0.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-85024: 6.25.0 to 6.28.0 (6.28.1 is outside it); 7.28.0 to 7.29.0 (7.29.1 is outside it); 8.1.0 to 8.10.1 (8.10.2 is outside it) - CVE-2026-15157: 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it) - CVE-2026-14643: 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it) - CVE-2026-16728: 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it) - CVE-2026-16729: 0.1.0 to 6.27.0 (6.28.0 is outside it); 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it) - CVE-2026-13697: 7.0.0 to 7.28.0 (7.29.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it) - CVE-2026-11525: 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-6733: 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-9678: 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-9679: 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-9697: 7.23.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-6734: 7.23.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.1.0 (8.2.0 is outside it) - CVE-2026-9675: 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-12151: 0.1.0 to 6.26.0 (6.27.0 is outside it); 7.0.0 to 7.27.2 (7.28.0 is outside it); 8.0.0 to 8.4.1 (8.5.0 is outside it) - CVE-2026-2229: 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-1528: 6.0.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-1527: 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-2581: 7.17.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-1526: 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-1525: 0.1.0 to 6.23.0 (6.24.0 is outside it); 7.0.0 to 7.23.0 (7.24.0 is outside it) - CVE-2026-22036: 0.1.0 to 6.22.0 (6.23.0 is outside it); 7.0.0 to 7.18.1 (7.18.2 is outside it) - CVE-2025-47279: 0.1.0 to 5.28.5 (5.29.0 is outside it); 6.0.0 to 6.21.1 (6.21.2 is outside it); 7.0.0 to 7.4.0 (7.5.0 is outside it) - CVE-2025-22150: 4.5.0 to 5.28.4 (5.28.5 is outside it); 6.0.0 to 6.21.0 (6.21.1 is outside it); 7.0.0 to 7.2.2 (7.2.3 is outside it) - CVE-2024-38372: 6.14.0 to 6.19.1 (6.19.2 is outside it) - CVE-2024-30260: 0.1.0 to 5.28.3 (5.28.4 is outside it); 6.0.0 to 6.11.0 (6.11.1 is outside it) - CVE-2024-30261: 0.1.0 to 5.28.3 (5.28.4 is outside it); 6.0.0 to 6.11.0 (6.11.1 is outside it) - CVE-2024-24750: 6.0.0 to 6.6.0 (6.6.1 is outside it) - CVE-2024-24758: 0.1.0 to 5.28.2 (5.28.3 is outside it); 6.0.0 to 6.6.0 (6.6.1 is outside it) - CVE-2023-45143: 0.1.0 to 5.26.1 (5.26.2 is outside it) - CVE-2023-23936: 2.0.0 to 5.19.0 (5.19.1 is outside it) - CVE-2023-24807: 0.1.0 to 5.19.0 (5.19.1 is outside it) - CVE-2022-35948: 0.1.0 to 5.8.1 (5.8.2 is outside it) - CVE-2022-35949: 0.1.0 to 5.8.1 (5.8.2 is outside it) - CVE-2022-31151: 0.1.0 to 5.7.0 (5.8.0 is outside it) - CVE-2022-31150: 0.1.0 to 5.7.0 (5.8.0 is outside it) - CVE-2022-32210: 4.8.2 to 5.5.0 (5.5.1 is outside it) ## Advisories (54) ### [CVE-2026-109932](https://cve.now/CVE-2026-109932): undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering - Severity: Medium 5.9 - Published: Oct 15, 2026 - Affected: from 5.15.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 56% of undici downloads last week were affected versions (188.4M). ### [CVE-2026-87018](https://cve.now/CVE-2026-87018): undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: from 4.2.1, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 56% of undici downloads last week were affected versions (189.2M). ### [CVE-2026-109383](https://cve.now/CVE-2026-109383): undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent - Severity: High 7.4 - Published: Oct 15, 2026 - Affected: from 4.0.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 56% of undici downloads last week were affected versions (189.2M). ### [CVE-2026-109829](https://cve.now/CVE-2026-109829): undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects - Severity: High 7.4 - Published: Oct 15, 2026 - Affected: from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 35% of undici downloads last week were affected versions (116M). ### [CVE-2026-109841](https://cve.now/CVE-2026-109841): undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens - Severity: Medium 5.9 - Published: Oct 15, 2026 - Affected: from 7.15.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 34% of undici downloads last week were affected versions (113.5M). ### [CVE-2026-109924](https://cve.now/CVE-2026-109924): undici vulnerable to Denial of Service via unbounded memory in the EventSource parser - Severity: Medium 5.9 - Published: Oct 15, 2026 - Affected: from 6.5.0, fixed in 6.29.1; from 7.0.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 47% of undici downloads last week were affected versions (156.9M). ### [CVE-2026-109869](https://cve.now/CVE-2026-109869): undici vulnerable to Denial of Service via unhandled error on excessive content-encodings - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: from 6.23.0, fixed in 6.29.1; from 7.18.0, fixed in 7.30.1; from 8.0.0, fixed in 8.12.2. - Fixed in 6.29.1 (released Oct 15, 2026, the day of disclosure), 7.30.1 (released Oct 15, 2026, the day of disclosure) and 8.12.2 (released Oct 15, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 43% of undici downloads last week were affected versions (144M). ### [CVE-2026-109855](https://cve.now/CVE-2026-109855): undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: from 8.11.0, fixed in 8.11.2. - Fixed in 8.11.2 (released Sep 24, 2026, 21 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.2% of undici downloads last week were affected versions (544.5K). ### [CVE-2026-18149](https://cve.now/CVE-2026-18149): undici vulnerable to Denial of Service via orphaned RetryHandler response body - Severity: Medium 5.9 - Published: Sep 4, 2026 - Affected: from 7.11.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 20% of undici downloads last week were affected versions (67.1M). ### [CVE-2026-18540](https://cve.now/CVE-2026-18540): undici vulnerable to downstream response splitting via retry interceptor - Severity: Low 3.7 - Published: Sep 4, 2026 - Affected: fixed in 6.28.1; from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 38% of undici downloads last week were affected versions (128.2M). ### [CVE-2026-19534](https://cve.now/CVE-2026-19534): undici vulnerable to Denial of Service via unrequested WebSocket subprotocol - Severity: High 7.5 - Published: Sep 4, 2026 - Affected: from 6.7.0, fixed in 6.28.1; from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 29% of undici downloads last week were affected versions (95.8M). ### [CVE-2026-84890](https://cve.now/CVE-2026-84890): undici vulnerable to Denial of Service via unbounded decompression of compressed responses - Severity: Medium 5.9 - Published: Sep 4, 2026 - Affected: from 7.15.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 19% of undici downloads last week were affected versions (65.3M). ### [CVE-2026-84933](https://cve.now/CVE-2026-84933): undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches - Severity: Medium 6.5 - Published: Sep 4, 2026 - Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 20% of undici downloads last week were affected versions (67.8M). ### [CVE-2026-84947](https://cve.now/CVE-2026-84947): undici vulnerable to response truncation via oversized chunked responses in the dump interceptor - Severity: Low 3.7 - Published: Sep 4, 2026 - Affected: from 7.1.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 20% of undici downloads last week were affected versions (67.8M). ### [CVE-2026-84961](https://cve.now/CVE-2026-84961): undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool - Severity: High 7.4 - Published: Sep 4, 2026 - Affected: from 7.24.1, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 17% of undici downloads last week were affected versions (58.5M). ### [CVE-2026-85008](https://cve.now/CVE-2026-85008): undici vulnerable to caching and replay of unsafe HTTP method responses - Severity: Low 3.7 - Published: Sep 4, 2026 - Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 20% of undici downloads last week were affected versions (67.8M). ### [CVE-2026-85152](https://cve.now/CVE-2026-85152): undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors - Severity: High 7.4 - Published: Sep 4, 2026 - Affected: from 8.10.0, fixed in 8.10.2. - Fixed in 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 1.4% of undici downloads last week were affected versions (4.7M). ### [CVE-2026-85014](https://cve.now/CVE-2026-85014): undici vulnerable to Denial of Service via WebSocketStream unclean close - Severity: Medium 5.9 - Published: Sep 4, 2026 - Affected: from 7.0.0, fixed in 7.29.1; from 8.0.0, fixed in 8.10.2. - Fixed in 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 20% of undici downloads last week were affected versions (67.8M). ### [CVE-2026-85024](https://cve.now/CVE-2026-85024): undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression - Severity: Medium 5.9 - Published: Sep 4, 2026 - Affected: from 6.25.0, fixed in 6.28.1; from 7.28.0, fixed in 7.29.1; from 8.1.0, fixed in 8.10.2. - Fixed in 6.28.1 (released Sep 4, 2026, the day of disclosure), 7.29.1 (released Sep 4, 2026, the day of disclosure) and 8.10.2 (released Sep 4, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 17% of undici downloads last week were affected versions (57.4M). ### [CVE-2026-15157](https://cve.now/CVE-2026-15157): undici vulnerable to CRLF Injection via blob-like body 'type' property - Severity: Medium 4.2 - Published: Jul 29, 2026 - Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0. - Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 28% of undici downloads last week were affected versions (95.6M). ### [CVE-2026-14643](https://cve.now/CVE-2026-14643): undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - Severity: Medium 5.9 - Published: Jul 29, 2026 - Affected: from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0. - Fixed in 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 12% of undici downloads last week were affected versions (41.6M). ### [CVE-2026-16728](https://cve.now/CVE-2026-16728): undici vulnerable to downstream response desynchronization via retry interceptor - Severity: Medium 4.8 - Published: Jul 29, 2026 - Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0. - Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 28% of undici downloads last week were affected versions (95.6M). ### [CVE-2026-16729](https://cve.now/CVE-2026-16729): undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - Severity: Medium 4.8 - Published: Jul 29, 2026 - Affected: fixed in 6.28.0; from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0. - Fixed in 6.28.0 (released Jul 24, 2026, 5 days before disclosure), 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 28% of undici downloads last week were affected versions (95.6M). ### [CVE-2026-13697](https://cve.now/CVE-2026-13697): undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - Severity: High 7.4 - Published: Jul 29, 2026 - Affected: from 7.0.0, fixed in 7.29.0; from 8.0.0, fixed in 8.9.0. - Fixed in 7.29.0 (released Jul 24, 2026, 5 days before disclosure) and 8.9.0 (released Jul 24, 2026, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 12% of undici downloads last week were affected versions (41.6M). ### [CVE-2026-11525](https://cve.now/CVE-2026-11525): undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching - Severity: Low 3.7 - Published: Jun 17, 2026 - Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 23% of undici downloads last week were affected versions (75.8M). ### [CVE-2026-6733](https://cve.now/CVE-2026-6733): undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse - Severity: Low 3.7 - Published: Jun 17, 2026 - Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 23% of undici downloads last week were affected versions (75.8M). ### [CVE-2026-9678](https://cve.now/CVE-2026-9678): undici vulnerable to cross-user information disclosure via shared cache whitespace bypass - Severity: Medium 5.9 - Published: Jun 17, 2026 - Affected: from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 7.7% of undici downloads last week were affected versions (25.9M). ### [CVE-2026-9679](https://cve.now/CVE-2026-9679): undici vulnerable to HTTP header injection via Set-Cookie percent-decoding - Severity: Medium 5.9 - Published: Jun 17, 2026 - Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 23% of undici downloads last week were affected versions (75.8M). ### [CVE-2026-9697](https://cve.now/CVE-2026-9697): undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent - Severity: High 7.4 - Published: Jun 17, 2026 - Affected: from 7.23.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 5% of undici downloads last week were affected versions (16.8M). ### [CVE-2026-6734](https://cve.now/CVE-2026-6734): undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: from 7.23.0, fixed in 7.28.0; from 8.0.0, fixed in 8.2.0. - Fixed in 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.2.0 (released May 1, 2026, 47 days before disclosure). - The latest release, 8.12.4, is not affected. - 4.8% of undici downloads last week were affected versions (16.3M). ### [CVE-2026-9675](https://cve.now/CVE-2026-9675): undici WebSocket client vulnerable to denial of service via cumulative fragment bypass - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: from 8.0.0, fixed in 8.5.0. - Fixed in 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.2% of undici downloads last week were affected versions (688.8K). ### [CVE-2026-12151](https://cve.now/CVE-2026-12151): undici WebSocket client vulnerable to denial of service via fragment count bypass - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: fixed in 6.27.0; from 7.0.0, fixed in 7.28.0; from 8.0.0, fixed in 8.5.0. - Fixed in 6.27.0 (released Jun 15, 2026, 2 days before disclosure), 7.28.0 (released Jun 15, 2026, 2 days before disclosure) and 8.5.0 (released Jun 15, 2026, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 23% of undici downloads last week were affected versions (75.8M). ### [CVE-2026-2229](https://cve.now/CVE-2026-2229): undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server\_max\_window\_bits Validation - Severity: High 7.5 - Published: Mar 12, 2026 - Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0. - Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 15% of undici downloads last week were affected versions (50.8M). ### [CVE-2026-1528](https://cve.now/CVE-2026-1528): undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client - Severity: High 7.5 - Published: Mar 12, 2026 - Affected: from 6.0.0, fixed in 6.24.0; from 7.0.0, fixed in 7.24.0. - Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 5.5% of undici downloads last week were affected versions (18.4M). ### [CVE-2026-1527](https://cve.now/CVE-2026-1527): undici is vulnerable to CRLF Injection via upgrade option - Severity: Medium 4.6 - Published: Mar 12, 2026 - Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0. - Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 15% of undici downloads last week were affected versions (50.8M). ### [CVE-2026-2581](https://cve.now/CVE-2026-2581): undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS - Severity: Medium 5.9 - Published: Mar 12, 2026 - Affected: from 7.17.0, fixed in 7.24.0. - Fixed in 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 1% of undici downloads last week were affected versions (3.4M). ### [CVE-2026-1526](https://cve.now/CVE-2026-1526): undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression - Severity: High 7.5 - Published: Mar 12, 2026 - Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0. - Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 15% of undici downloads last week were affected versions (50.8M). ### [CVE-2026-1525](https://cve.now/CVE-2026-1525): undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') - Severity: Medium 6.5 - Published: Mar 12, 2026 - Affected: fixed in 6.24.0; from 7.0.0, fixed in 7.24.0. - Fixed in 6.24.0 (released Mar 12, 2026, the day of disclosure) and 7.24.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 8.12.4, is not affected. - 15% of undici downloads last week were affected versions (50.8M). ### [CVE-2026-22036](https://cve.now/CVE-2026-22036): Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - Severity: Medium 5.9 - Published: Jan 14, 2026 - Affected: from 7.0.0, fixed in 7.18.2; fixed in 6.23.0. - Fixed in 6.23.0 (released Jan 5, 2026, 9 days before disclosure) and 7.18.2 (released Jan 6, 2026, 8 days before disclosure). - The latest release, 8.12.4, is not affected. - 13% of undici downloads last week were affected versions (45.2M). ### [CVE-2025-47279](https://cve.now/CVE-2025-47279): undici Denial of Service attack via bad certificate data - Severity: Low 3.1 - Published: May 15, 2025 - Affected: fixed in 5.29.0; from 6.0.0, fixed in 6.21.2; from 7.0.0, fixed in 7.5.0. - Fixed in 5.29.0 (released Mar 19, 2025, 57 days before disclosure), 6.21.2 (released Mar 13, 2025, 63 days before disclosure) and 7.5.0 (released Mar 12, 2025, 64 days before disclosure). - The latest release, 8.12.4, is not affected. - 4.2% of undici downloads last week were affected versions (14.1M). ### [CVE-2025-22150](https://cve.now/CVE-2025-22150): Undici Uses Insufficiently Random Values - Severity: Medium 6.8 - Published: Jan 21, 2025 - Affected: from 4.5.0, fixed in 5.28.5; from 6.0.0, fixed in 6.21.1; from 7.0.0, fixed in 7.2.3. - Fixed in 5.28.5 (released Jan 16, 2025, 5 days before disclosure), 6.21.1 (released Jan 16, 2025, 5 days before disclosure) and 7.2.3 (released Jan 16, 2025, 5 days before disclosure). - The latest release, 8.12.4, is not affected. - 3.8% of undici downloads last week were affected versions (12.8M). ### [CVE-2024-38372](https://cve.now/CVE-2024-38372): Undici vulnerable to data leak when using response.arrayBuffer() - Severity: Low 2.0 - Published: Jul 8, 2024 - Affected: from 6.14.0, fixed in 6.19.2. - Fixed in 6.19.2 (released Jun 18, 2024, 20 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (110.4K). ### [CVE-2024-30260](https://cve.now/CVE-2024-30260): Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline - Severity: Low 3.9 - Published: Apr 4, 2024 - Affected: fixed in 5.28.4; from 6.0.0, fixed in 6.11.1. - Fixed in 5.28.4 (released Apr 2, 2024, 2 days before disclosure) and 6.11.1 (released Apr 2, 2024, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.9% of undici downloads last week were affected versions (3M). ### [CVE-2024-30261](https://cve.now/CVE-2024-30261): Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - Severity: Low 2.6 - Published: Apr 4, 2024 - Affected: fixed in 5.28.4; from 6.0.0, fixed in 6.11.1. - Fixed in 5.28.4 (released Apr 2, 2024, 2 days before disclosure) and 6.11.1 (released Apr 2, 2024, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.9% of undici downloads last week were affected versions (3M). ### [CVE-2024-24750](https://cve.now/CVE-2024-24750): Backpressure request ignored in fetch() in Undici - Severity: Medium 6.5 - Published: Feb 16, 2024 - Affected: from 6.0.0, fixed in 6.6.1. - Fixed in 6.6.1 (released Feb 5, 2024, 11 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (22.4K). ### [CVE-2024-24758](https://cve.now/CVE-2024-24758): Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici - Severity: Low 3.9 - Published: Feb 16, 2024 - Affected: fixed in 5.28.3; from 6.0.0, fixed in 6.6.1. - Fixed in 5.28.3 (released Feb 5, 2024, 11 days before disclosure) and 6.6.1 (released Feb 5, 2024, 11 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.8% of undici downloads last week were affected versions (2.5M). ### [CVE-2023-45143](https://cve.now/CVE-2023-45143): Undici's cookie header not cleared on cross-origin redirect in fetch - Severity: Low 3.9 - Published: Oct 12, 2023 - Affected: fixed in 5.26.2. - Fixed in 5.26.2 (released Oct 11, 2023, 1 day before disclosure). - The latest release, 8.12.4, is not affected. - 0.4% of undici downloads last week were affected versions (1.3M). ### [CVE-2023-23936](https://cve.now/CVE-2023-23936): CRLF Injection in Nodejs ‘undici’ via host - Severity: Medium 6.5 - Published: Feb 16, 2023 - Affected: from 2.0.0, fixed in 5.19.1. - Fixed in 5.19.1 (released Feb 13, 2023, 3 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.2% of undici downloads last week were affected versions (782.6K). ### [CVE-2023-24807](https://cve.now/CVE-2023-24807): Undici vulnerable to Regular Expression Denial of Service in Headers - Severity: High 7.5 - Published: Feb 16, 2023 - Affected: fixed in 5.19.1. - Fixed in 5.19.1 (released Feb 13, 2023, 3 days before disclosure). - The latest release, 8.12.4, is not affected. - 0.2% of undici downloads last week were affected versions (784.6K). ### [CVE-2022-35948](https://cve.now/CVE-2022-35948): CRLF Injection in Nodejs ‘undici’ via Content-Type - Severity: Medium 5.3 - Published: Aug 13, 2022 - Affected: fixed in 5.8.2. - Fixed in 5.8.2 (released Aug 9, 2022, 4 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (301.1K). ### [CVE-2022-35949](https://cve.now/CVE-2022-35949): \`undici.request\` vulnerable to SSRF using absolute URL on \`pathname\` - Severity: Medium 5.3 - Published: Aug 12, 2022 - Affected: fixed in 5.8.2. - Fixed in 5.8.2 (released Aug 9, 2022, 3 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (301.1K). ### [CVE-2022-31151](https://cve.now/CVE-2022-31151): Uncleared cookies on cross-host/cross-origin redirect in undici - Severity: Low 3.7 - Published: Jul 20, 2022 - Affected: fixed in 5.8.0. - Fixed in 5.8.0 (released Jul 18, 2022, 2 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (271.8K). ### [CVE-2022-31150](https://cve.now/CVE-2022-31150): CRLF injection in request headers - Severity: Medium 5.3 - Published: Jul 19, 2022 - Affected: fixed in 5.8.0. - Fixed in 5.8.0 (released Jul 18, 2022, 1 day before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (271.8K). ### [CVE-2022-32210](https://cve.now/CVE-2022-32210): \`Undici.ProxyAgent\` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. - Severity: Unrated - Published: Jul 14, 2022 - Affected: from 4.8.2, fixed in 5.5.1. - Fixed in 5.5.1 (released Jun 13, 2022, 31 days before disclosure). - The latest release, 8.12.4, is not affected. - <0.1% of undici downloads last week were affected versions (153.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/undici Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.