Uundici

Products

Exploited and recent CVEs

• CVE-2026-87029 Medium 5.9 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor 0.3%
• CVE-2026-109932 Medium 5.9 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering 0.3%
• CVE-2026-87018 High 7.5 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation 0.2%
• CVE-2026-109383 High 7.4 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent 0.2%
• CVE-2026-109829 High 7.4 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects 0.1%
• CVE-2026-109841 Medium 5.9 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens 0.3%
• CVE-2026-109924 Medium 5.9 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser 0.3%
• CVE-2026-109869 High 7.5 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings 0.3%
• CVE-2026-109855 High 7.5 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake 0.3%
• CVE-2026-18149 Medium 5.9 undici vulnerable to Denial of Service via orphaned RetryHandler response body 0.5%
• CVE-2026-18540 Low 3.7 undici vulnerable to downstream response splitting via retry interceptor 0.3%
• CVE-2026-19534 High 7.5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol 0.4%
• CVE-2026-84890 Medium 5.9 undici vulnerable to Denial of Service via unbounded decompression of compressed responses 0.4%
• CVE-2026-84933 Medium 6.5 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches 0.3%
• CVE-2026-84947 Low 3.7 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor 0.2%
• CVE-2026-84961 High 7.4 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool 0.2%
• CVE-2026-85008 Low 3.7 undici vulnerable to caching and replay of unsafe HTTP method responses 0.1%
• CVE-2026-85152 High 7.4 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors 0.2%
• CVE-2026-85014 Medium 5.9 undici vulnerable to Denial of Service via WebSocketStream unclean close 0.4%
• CVE-2026-85024 Medium 5.9 undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression 0.4%
• CVE-2026-15157 Medium 4.2 undici vulnerable to CRLF Injection via blob-like body 'type' property 0.3%
• CVE-2026-14643 Medium 5.9 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives 0.4%
• CVE-2026-16728 Medium 4.8 undici vulnerable to downstream response desynchronization via retry interceptor 0.3%
• CVE-2026-16729 Medium 4.8 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 0.3%
• CVE-2026-13697 High 7.4 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives 0.6%
• CVE-2026-11525 Low 3.7 undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 0.2%
• CVE-2026-6733 Low 3.7 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 0.2%
• CVE-2026-9678 Medium 5.9 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass 0.4%
• CVE-2026-9679 Medium 5.9 undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 0.3%
• CVE-2026-9697 High 7.4 undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent 0.5%