Undici

undici vulnerable to Denial of Service via orphaned RetryHandler response body

Sep 4, 2026

undici vulnerable to downstream response splitting via retry interceptor

Sep 4, 2026

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Sep 4, 2026

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Sep 4, 2026

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Sep 4, 2026

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Sep 4, 2026

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

Sep 4, 2026

undici vulnerable to caching and replay of unsafe HTTP method responses

Sep 4, 2026

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Sep 4, 2026

undici vulnerable to Denial of Service via WebSocketStream unclean close

Sep 4, 2026

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

Sep 4, 2026

undici vulnerable to CRLF Injection via blob-like body 'type' property

Jul 29, 2026

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Jul 29, 2026

undici vulnerable to downstream response desynchronization via retry interceptor

Jul 29, 2026

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Jul 29, 2026

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Jul 29, 2026

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Jun 17, 2026

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Jun 17, 2026

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Jun 17, 2026

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Jun 17, 2026

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Jun 17, 2026

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Jun 17, 2026

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Jun 17, 2026

undici WebSocket client vulnerable to denial of service via fragment count bypass

Jun 17, 2026

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Mar 12, 2026