| High | undici vulnerable to Denial of Service via unrequested WebSocket subprotocolGHSA-rfgv-xxqx-mfg5 · 29 Sept 2026 | >= 6.7.0, < 6.28.1 · >= 7.0.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| High | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolGHSA-w293-vg96-wgc3 · 29 Sept 2026 | >= 7.24.1, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| High | undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsGHSA-vp8m-p9jh-q5pm · 29 Sept 2026 | >= 8.10.0, < 8.10.2 | 8.10.2 |
| High | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesGHSA-4cwx-7wf7-3272 · 3 Aug 2026 | >= 7.0.0, < 7.29.0 · >= 8.0.0, < 8.9.0 | 8.9.0 |
| High | undici WebSocket client vulnerable to denial of service via fragment count bypassGHSA-vxpw-j846-p89q · 19 Jun 2026 | < 6.27.0 · >= 7.0.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| High | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseGHSA-hm92-r4w5-c3mj · 19 Jun 2026 | >= 7.23.0, < 7.28.0 · >= 8.0.0, < 8.2.0 | 8.2.0 |
| High | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentGHSA-vmh5-mc38-953g · 18 Jun 2026 | >= 7.23.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| High | undici WebSocket client vulnerable to denial of service via cumulative fragment bypassGHSA-38rv-x7px-6hhq · 18 Jun 2026 | >= 8.0.0, < 8.5.0 | 8.5.0 |
| High | Undici has Unbounded Memory Consumption in WebSocket permessage-deflate DecompressionGHSA-vrm6-8vpv-qv8q · 13 Mar 2026 | < 6.24.0 · >= 7.0.0, < 7.24.0 | 7.24.0 |
| High | Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits ValidationGHSA-v9p9-hfj2-hcw8 · 13 Mar 2026 | < 6.24.0 · >= 7.0.0, < 7.24.0 | 7.24.0 |
| High | Undici: Malicious WebSocket 64-bit length overflows parser and crashes the clientGHSA-f269-vfmq-vjvj · 13 Mar 2026 | >= 6.0.0, < 6.24.0 · >= 7.0.0, < 7.24.0 | 7.24.0 |
| High | Regular Expression Denial of Service in HeadersGHSA-r6ch-mqf9-qc9w · 16 Feb 2023 | < 5.19.1 | 5.19.1 |
| High | ProxyAgent vulnerable to MITMGHSA-pgw7-wx7w-2w33 · 17 Jun 2022 | >= 4.8.2, < 5.5.1 | 5.5.1 |
| Moderate | undici vulnerable to Denial of Service via orphaned RetryHandler response bodyGHSA-pmjh-fq2x-6v4x · 29 Sept 2026 | >= 7.11.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Moderate | undici vulnerable to Denial of Service via unbounded decompression of compressed responsesGHSA-3xpg-4rpp-hhhm · 29 Sept 2026 | >= 7.15.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Moderate | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesGHSA-2jfj-6hjv-fm6j · 29 Sept 2026 | >= 7.0.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Moderate | undici vulnerable to Denial of Service via WebSocketStream unclean closeGHSA-rx4f-c7p8-82vq · 29 Sept 2026 | >= 7.0.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Moderate | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionGHSA-3wwx-pv8p-q78v · 28 Sept 2026 | >= 6.25.0, < 6.28.1 · >= 7.28.0, < 7.29.1 · >= 8.1.0, < 8.10.2 | 8.10.2 |
| Moderate | undici vulnerable to CRLF Injection via blob-like body 'type' propertyGHSA-m8rv-5g2x-5cg5 · 3 Aug 2026 | < 6.28.0 · >= 7.0.0, < 7.29.0 · >= 8.0.0, < 8.9.0 | 8.9.0 |
| Moderate | undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesGHSA-jr45-8vmc-qm54 · 3 Aug 2026 | >= 7.0.0, < 7.29.0 · >= 8.0.0, < 8.9.0 | 8.9.0 |
| Moderate | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsGHSA-v3r7-h72x-cjcm · 3 Aug 2026 | < 6.28.0 · >= 7.0.0, < 7.29.0 · >= 8.0.0, < 8.9.0 | 8.9.0 |
| Moderate | undici vulnerable to downstream response desynchronization via retry interceptorGHSA-8xcm-r25x-g524 · 3 Aug 2026 | < 6.28.0 · >= 7.0.0, < 7.29.0 · >= 8.0.0, < 8.9.0 | 8.9.0 |
| Moderate | undici vulnerable to HTTP header injection via Set-Cookie percent-decodingGHSA-p88m-4jfj-68fv · 19 Jun 2026 | < 6.27.0 · >= 7.0.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| Moderate | undici vulnerable to cross-user information disclosure via shared cache whitespace bypassGHSA-pr7r-676h-xcf6 · 18 Jun 2026 | >= 7.0.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| Moderate | Undici has CRLF Injection in undici via `upgrade` optionGHSA-4992-7rv2-5pvq · 13 Mar 2026 | < 6.24.0 · >= 7.0.0, < 7.24.0 | 7.24.0 |
| Moderate | Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoSGHSA-phc3-fgpg-7m6h · 13 Mar 2026 | >= 7.17.0, < 7.24.0 | 7.24.0 |
| Moderate | Undici has an HTTP Request/Response Smuggling issueGHSA-2mjp-6q6p-2qxm · 13 Mar 2026 | < 6.24.0 · >= 7.0.0, < 7.24.0 | 7.24.0 |
| Moderate | Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionGHSA-g9mf-h72j-4rw9 · 14 Jan 2026 | >= 7.0.0, < 7.18.2 · < 6.23.0 | 7.18.2 |
| Moderate | Use of Insufficiently Random Values in undiciGHSA-c76h-2ccp-4975 · 21 Jan 2025 | >= 4.5.0, < 5.28.5 · >= 6.0.0, < 6.21.1 · >= 7.0.0, < 7.2.3 | 7.2.3 |
| Moderate | fetch(url) leads to a memory leak in undiciGHSA-9f24-jqhm-jfcw · 16 Feb 2024 | >= 6.0.0, < 6.6.1 | 6.6.1 |
| Moderate | CRLF Injection in Nodejs ‘undici’ via hostGHSA-5r9g-qh6m-jxff · 16 Feb 2023 | >= 2.0.0, < 5.19.1 | 5.19.1 |
| Moderate | Nodejs ‘undici’ vulnerable to CRLF Injection via Content-TypeGHSA-f772-66g8-q5h3 · 18 Aug 2022 | < 5.8.2 | 5.8.2 |
| Moderate | `undici.request` vulnerable to SSRF using absolute URL on `pathname`GHSA-8qr4-xgw6-wmr3 · 18 Aug 2022 | < 5.8.2 | 5.8.2 |
| Moderate | undici before v5.8.0 vulnerable to CRLF injection in request headersGHSA-3cvr-822r-rqcc · 21 Jul 2022 | < 5.8.0 | 5.8.0 |
| Low | undici vulnerable to downstream response splitting via retry interceptorGHSA-r53p-7pc4-xj5r · 29 Sept 2026 | < 6.28.1 · >= 7.0.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Low | undici vulnerable to response truncation via oversized chunked responses in the dump interceptorGHSA-2gqq-gqf2-x968 · 29 Sept 2026 | >= 7.1.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Low | undici vulnerable to caching and replay of unsafe HTTP method responsesGHSA-8436-99hf-9mmv · 29 Sept 2026 | >= 7.0.0, < 7.29.1 · >= 8.0.0, < 8.10.2 | 8.10.2 |
| Low | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingGHSA-g8m3-5g58-fq7m · 19 Jun 2026 | < 6.27.0 · >= 7.0.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| Low | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuseGHSA-35p6-xmwp-9g52 · 19 Jun 2026 | < 6.27.0 · >= 7.0.0, < 7.28.0 · >= 8.0.0, < 8.5.0 | 8.5.0 |
| Low | undici Denial of Service attack via bad certificate dataGHSA-cxrh-j4jr-qwg3 · 15 May 2025 | < 5.29.0 · >= 6.0.0, < 6.21.2 · >= 7.0.0, < 7.5.0 | 7.5.0 |
| Low | Undici vulnerable to data leak when using response.arrayBuffer()GHSA-3g92-w8c5-73pq · 9 Jul 2024 | >= 6.14.0, < 6.19.2 | 6.19.2 |
| Low | Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectGHSA-9qxr-qj54-h672 · 4 Apr 2024 | < 5.28.4 · >= 6.0.0, < 6.11.1 | 6.11.1 |
| Low | Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelineGHSA-m4v8-wqvr-p9f7 · 4 Apr 2024 | < 5.28.4 · >= 6.0.0, < 6.11.1 | 6.11.1 |
| Low | Undici proxy-authorization header not cleared on cross-origin redirect in fetchGHSA-3787-6prv-h9w3 · 16 Feb 2024 | < 5.28.3 · >= 6.0.0, < 6.6.1 | 6.6.1 |
| Low | Undici's cookie header not cleared on cross-origin redirect in fetchGHSA-wqq4-5wpv-mx2g · 16 Oct 2023 | < 5.26.2 | 5.26.2 |
| Low | undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirectGHSA-q768-x9m6-m9qp · 21 Jul 2022 | < 5.8.0 | 5.8.0 |