Nodejs Undici vulnerabilities

CVE-2026-1525 [CRITICAL] CWE-444 CVE-2026-1525: Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-var Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level

CVE-2026-109829 [CRITICAL] CWE-346 CVE-2026-109829: undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.1 undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after

CVE-2026-13697 [CRITICAL] CWE-200 CVE-2026-13697: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache

CVE-2026-6734 [HIGH] CWE-346 CVE-2026-6734: Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request

CVE-2022-35949 [CRITICAL] CWE-918 CVE-2022-35949: undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Serve undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({ori

CVE-2026-109383 [CRITICAL] CWE-295 CVE-2026-109383: undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0 undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a

CVE-2026-84961 [CRITICAL] CWE-295 CVE-2026-84961: undici's BalancedPool constructor passes its entire options object through an internal deep-clone th undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded befo

CVE-2026-84933 [HIGH] CWE-200 CVE-2026-84933: undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-serv

CVE-2026-9697 [HIGH] CWE-295 CVE-2026-9697: Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or cor

CVE-2026-2229 [HIGH] CWE-248 CVE-2026-2229: ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper valida ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range ser

CVE-2026-12151 [HIGH] CWE-400 CVE-2026-12151: Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragment Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth

CVE-2026-14643 [HIGH] CWE-436 CVE-2026-14643: undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualifi undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recogn

CVE-2026-85152 [HIGH] CWE-346 CVE-2026-85152: undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the ca undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted

CVE-2026-1526 [HIGH] CWE-409 CVE-2026-1526: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consump The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket serv

CVE-2026-85014 [HIGH] CWE-248 CVE-2026-85014: undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer cl undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locke

CVE-2026-109932 [HIGH] CWE-400 CVE-2026-109932: undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30. undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writ

CVE-2026-9675 [HIGH] CWE-400 CVE-2026-9675: Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumul Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The resul

CVE-2026-19534 [HIGH] CWE-248 CVE-2026-19534: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a serv undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against th

CVE-2026-109869 [HIGH] CWE-248 CVE-2026-109869: undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30 undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses becaus

CVE-2026-109841 [HIGH] CWE-178 CVE-2026-109841: undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8. undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token