undici vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-2229Highundici: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-1527Mediumundici: Undici has CRLF Injection in undici via `upgrade` option CVE-2026-2581Mediumundici: Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS CVE-2026-1528Highundici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE-2026-1525Mediumundici: Undici has an HTTP Request/Response Smuggling issue CVE-2026-22036Mediumundici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion CVE-2025-47279Lowundici: undici Denial of Service attack via bad certificate data CVE-2025-22150Mediumundici: Use of Insufficiently Random Values in undici CVE-2024-38372Lowundici: Undici vulnerable to data leak when using response.arrayBuffer()CVE-2024-30261Lowundici: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect CVE-2024-30260Lowundici: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline CVE-2024-24758Lowundici: Undici proxy-authorization header not cleared on cross-origin redirect in fetch CVE-2024-24750Mediumundici: fetch(url) leads to a memory leak in undici CVE-2023-45143Lowundici: Undici's cookie header not cleared on cross-origin redirect in fetch CVE-2023-23936Mediumundici: CRLF Injection in Nodejs ‘undici’ via host CVE-2023-24807Highundici: Regular Expression Denial of Service in Headers CVE-2022-35948Mediumundici: Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type CVE-2022-35949Mediumundici: `undici.request` vulnerable to SSRF using absolute URL on `pathname`CVE-2022-31151Lowundici: undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect CVE-2022-31150Mediumundici: undici before v5.8.0 vulnerable to CRLF injection in request headers CVE-2022-32210Highundici: ProxyAgent vulnerable to MITM

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.