Security: nodejs/undici
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
undici vulnerable to CRLF Injection via blob-like body 'type' propertyGHSA-m8rv-5g2x-5cg5 published
Jul 29, 2026 by mcollinaModerate -
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesGHSA-jr45-8vmc-qm54 published
Jul 29, 2026 by mcollinaModerate -
undici vulnerable to downstream response desynchronization via retry interceptorGHSA-8xcm-r25x-g524 published
Jul 29, 2026 by mcollinaModerate -
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesGHSA-4cwx-7wf7-3272 published
Jul 29, 2026 by mcollinaHigh -
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsGHSA-v3r7-h72x-cjcm published
Jul 29, 2026 by mcollinaModerate -
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingGHSA-g8m3-5g58-fq7m published
Jun 17, 2026 by mcollinaLow -
undici WebSocket client vulnerable to denial of service via fragment count bypassGHSA-vxpw-j846-p89q published
Jun 17, 2026 by mcollinaHigh -
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentGHSA-vmh5-mc38-953g published
Jun 17, 2026 by mcollinaHigh -
undici vulnerable to cross-user information disclosure via shared cache whitespace bypassGHSA-pr7r-676h-xcf6 published
Jun 17, 2026 by mcollinaModerate -
undici vulnerable to HTTP header injection via Set-Cookie percent-decodingGHSA-p88m-4jfj-68fv published
Jun 17, 2026 by mcollinaModerate