VendorsNodejsundiciall versions
Vulnerabilities

Nodejs undici

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

52CVEs
CVE-2026-15157
undici vulnerable to CRLF Injection via blob-like body 'type' property
Published 2026-07-29 · Analyzed
5.4EPSS 0.003
CVE-2022-35948
CRLF Injection in Nodejs ‘undici’ via Content-Type
Published 2022-08-13 · Modified
5.3EPSS 0.014
CVE-2026-84947
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
Published 2026-09-04 · Analyzed
5.3EPSS 0.002
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
Published 2026-09-04 · Analyzed
5.3EPSS 0.001
CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option
Published 2026-03-12 · Analyzed
4.6EPSS 0.003
CVE-2024-24758
Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
Published 2024-02-16 · Analyzed
4.5EPSS 0.008
CVE-2024-30260
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Published 2024-04-04 · Modified
4.3EPSS 0.007
CVE-2023-45143
Undici's cookie header not cleared on cross-origin redirect in fetch
Published 2023-10-12 · Modified
3.9EPSS 0.014
CVE-2026-18540
undici vulnerable to downstream response splitting via retry interceptor
Published 2026-09-04 · Analyzed
3.7EPSS 0.003
CVE-2026-11525
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Published 2026-06-17 · Analyzed
3.7EPSS 0.002
CVE-2026-6733
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
Published 2026-06-17 · Analyzed
3.7EPSS 0.002
CVE-2024-30261
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Published 2024-04-04 · Modified
3.5EPSS 0.008
← Prev2 / 2