undici
npm55 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting undicipage 2 of 2
- CVE-2026-87029MEDIUMCVSS 7.5EG 5.9fixed in 7.30.1 or 8.12.2, by version range2026-10-15
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without cat…
- CVE-2026-9675HIGHCVSS 7.5EG 7.5fixed in 8.5.02026-06-17
Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame valid…
- CVE-2026-9678MEDIUMCVSS 5.9EG 5.9fixed in 7.28.0 or 8.5.0, by version range2026-06-17
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\ta…
- CVE-2026-9679MEDIUMCVSS 5.9EG 5.9fixed in 6.27.0, 7.28.0 or 8.5.0, by version range2026-06-17
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and b…
- CVE-2026-9697HIGHCVSS 7.4EG 7.4fixed in 7.28.0 or 8.5.0, by version range2026-06-17
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user…
Check whether undici is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for undici CVEs against the assets you own.
Book a Demo →