undici vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-18149Mediumundici: undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18540Lowundici: undici vulnerable to downstream response splitting via retry interceptor CVE-2026-19534Highundici: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-84890Mediumundici: undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84933Mediumundici: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84947Lowundici: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84961Highundici: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-85008Lowundici: undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85152Highundici: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85014Mediumundici: undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85024Mediumundici: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-15157Mediumundici: undici vulnerable to CRLF Injection via blob-like body 'type' property CVE-2026-14643Mediumundici: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives CVE-2026-16729Mediumundici: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields CVE-2026-16728Mediumundici: undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-13697Highundici: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives CVE-2026-11525Lowundici: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching CVE-2026-12151Highundici: undici WebSocket client vulnerable to denial of service via fragment count bypass CVE-2026-9679Mediumundici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding CVE-2026-6734Highundici: undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse CVE-2026-6733Lowundici: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse CVE-2026-9697Highundici: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent CVE-2026-9678Mediumundici: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass CVE-2026-9675Highundici: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass CVE-2026-1526Highundici: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo