nodejs undici
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-22036 | < 6.23.0 ; >= 7.0.0, < 7.18.2 | Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion | HIGH 7.5 | 0.5 % | ||
| CVE-2025-47279 | < 5.29.0 ; >= 6.0.0, < 6.21.2 ; >= 7.0.0, < 7.5.0 | undici Denial of Service attack via bad certificate data | LOW 3.1 | 0.3 % | ||
| CVE-2025-22150 | >= 4.5.0, < 5.28.5 ; >= 6.0.0, < 6.21.1 ; >= 7.0.0, < 7.2.3 | Undici Uses Insufficiently Random Values | MEDIUM 6.8 | 0.8 % | ||
| CVE-2024-38372 | >= 6.14.0, < 6.19.2 | Undici vulnerable to data leak when using response.arrayBuffer() | LOW 2.0 | 0.5 % | ||
| CVE-2024-30260 | < 5.28.4 ; >= 6.0.0, < 6.11.1 | Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-30261 | >= 6.0.0, < 6.11.1 ; < 5.28.4 | Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect | LOW 3.5 | 0.8 % | ||
| CVE-2024-24750 | >= 6.0.0, < 6.6.1 | Backpressure request ignored in fetch() in Undici | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-24758 | < 5.28.3 ; >= 6.0.0, < 6.6.1 | Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici | MEDIUM 4.5 | 0.8 % | ||
| CVE-2023-45143 | < 5.26.2 | Undici's cookie header not cleared on cross-origin redirect in fetch | LOW 3.9 | 1.4 % | ||
| CVE-2023-23936 | >=2.0.0, < 5.19.1 | CRLF Injection in Nodejs ‘undici’ via host | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-24807 | < 5.19.1 | Undici vulnerable to Regular Expression Denial of Service in Headers | HIGH 7.5 | 1.3 % | ||
| CVE-2022-35948 | =< 5.8.0 | CRLF Injection in Nodejs ‘undici’ via Content-Type | MEDIUM 5.3 | 1.4 % | ||
| CVE-2022-35949 | <= 5.8.1 | `undici.request` vulnerable to SSRF using absolute URL on `pathname` | CRITICAL 9.8 | 1.9 % | ||
| CVE-2022-31151 | < 5.7.1 | Uncleared cookies on cross-host/cross-origin redirect in undici | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-31150 | < v5.7.1, >= v5.8.0 | CRLF injection in request headers | MEDIUM 6.5 | 1.5 % |