| CVE-2026-87029 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109932 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-87018 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-109383 |
undici is an HTTP client library for Node.js
|
7.4
Élevée
|
15 oct. 2026 |
| CVE-2026-109829 |
undici is an HTTP client library for Node.js
|
7.4
Élevée
|
15 oct. 2026 |
| CVE-2026-109841 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109924 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109869 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-109855 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-18149 |
undici's retry handler can leave an already-exposed response body pending forever
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-18540 |
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier…
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-19534 |
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a…
|
7.5
Élevée
|
4 sept. 2026 |
| CVE-2026-84890 |
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-84933 |
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither…
|
6.5
Moyenne
|
4 sept. 2026 |
| CVE-2026-84947 |
undici's dump interceptor reads and discards a response body up to a configurable maximum size
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-84961 |
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and…
|
7.4
Élevée
|
4 sept. 2026 |
| CVE-2026-85008 |
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by…
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-85152 |
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate…
|
7.4
Élevée
|
4 sept. 2026 |
| CVE-2026-85014 |
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP…
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-85024 |
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal…
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-15157 |
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type…
|
4.2
Moyenne
|
29 juil. 2026 |
| CVE-2026-14643 |
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or…
|
5.9
Moyenne
|
29 juil. 2026 |
| CVE-2026-16728 |
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed…
|
4.8
Moyenne
|
29 juil. 2026 |
| CVE-2026-16729 |
undici's setCookie function does not fully sanitize cookie attributes
|
4.8
Moyenne
|
29 juil. 2026 |
| CVE-2026-13697 |
undici's cache interceptor mishandles malformed Cache-Control private directives
|
7.4
Élevée
|
29 juil. 2026 |