Undici vulnerabilities
45 CVEs and advisories name Undici as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-13697undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- CVE-2026-11525undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- CVE-2026-6733undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
- CVE-2026-9678undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
- CVE-2026-9679undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- CVE-2026-9697undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
- CVE-2026-6734undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
- CVE-2026-9675undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
- CVE-2026-12151undici WebSocket client vulnerable to denial of service via fragment count bypass
- CVE-2026-2229undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
- CVE-2026-1528undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
- CVE-2026-1527undici is vulnerable to CRLF Injection via upgrade option
- CVE-2026-2581undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS
- CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
- CVE-2026-1525undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')