Nodejs Undici vulnerabilities

CVE-2026-109924 [HIGH] CWE-770 CVE-2026-109924: undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0 undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished l

CVE-2026-109855 [HIGH] CWE-248 CVE-2026-109855: undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSoc undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error list

CVE-2026-87029 [HIGH] CWE-248 CVE-2026-87029: undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8. undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstre

CVE-2026-1528 [HIGH] CWE-248 CVE-2026-1528: ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

CVE-2026-22036 [HIGH] CWE-770 CVE-2026-22036: Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the dec Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

CVE-2026-87018 [HIGH] CWE-248 CVE-2026-87018: undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0 undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname ver

CVE-2023-24807 [HIGH] CWE-20 CVE-2023-24807: Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers. Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` u

CVE-2025-22150 [MEDIUM] CWE-330 CVE-2025-22150: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7. Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multi

CVE-2022-31150 [MEDIUM] CWE-93 CVE-2022-31150: undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequen undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.

CVE-2026-16729 [MEDIUM] CWE-74 CVE-2026-16729: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain

CVE-2022-32210 [MEDIUM] CWE-295 CVE-2022-32210: `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

CVE-2026-9678 [MEDIUM] CWE-524 CVE-2026-9678: Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstr Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authoriza

CVE-2026-9679 [MEDIUM] CWE-93 CVE-2026-9679: Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turni Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a

CVE-2026-2581 [MEDIUM] CWE-770 CVE-2026-2581: This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Serv This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this

CVE-2022-31151 [MEDIUM] CWE-601 CVE-2022-31151: Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensit Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection

CVE-2026-16728 [MEDIUM] CWE-444 CVE-2026-16728: undici's retry interceptor can deliver a response whose body length does not match the Content-Lengt undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatch

CVE-2026-18149 [MEDIUM] CWE-772 CVE-2026-18149: undici's retry handler can leave an already-exposed response body pending forever. When a server ret undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response d

CVE-2026-84890 [MEDIUM] CWE-770 CVE-2026-84890: undici's decompress interceptor decompresses response bodies according to the untrusted Content-Enco undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a com

CVE-2026-85024 [MEDIUM] CWE-248 CVE-2026-85024: undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte

CVE-2026-85008 [MEDIUM] CWE-345 CVE-2026-85008: undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip c undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also