| CVE-2026-116630 |
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
|
5.9
Moyenne
|
6 nov. 2026 |
| CVE-2026-120415 |
undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
|
5.9
Moyenne
|
6 nov. 2026 |
| CVE-2026-120423 |
undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
|
5.9
Moyenne
|
6 nov. 2026 |
| CVE-2026-116592 |
undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops
|
7.4
Élevée
|
6 nov. 2026 |
| CVE-2026-120222 |
undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
|
5.9
Moyenne
|
6 nov. 2026 |
| CVE-2026-120474 |
undici vulnerable to cross-user cache disclosure via same-origin redirect
|
6.5
Moyenne
|
6 nov. 2026 |
| CVE-2026-87029 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109932 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-87018 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-109383 |
undici is an HTTP client library for Node.js
|
7.4
Élevée
|
15 oct. 2026 |
| CVE-2026-109829 |
undici is an HTTP client library for Node.js
|
7.4
Élevée
|
15 oct. 2026 |
| CVE-2026-109841 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109924 |
undici is an HTTP client library for Node.js
|
5.9
Moyenne
|
15 oct. 2026 |
| CVE-2026-109869 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-109855 |
undici is an HTTP client library for Node.js
|
7.5
Élevée
|
15 oct. 2026 |
| CVE-2026-18149 |
undici's retry handler can leave an already-exposed response body pending forever
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-18540 |
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier…
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-19534 |
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a…
|
7.5
Élevée
|
4 sept. 2026 |
| CVE-2026-84890 |
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
|
5.9
Moyenne
|
4 sept. 2026 |
| CVE-2026-84933 |
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither…
|
6.5
Moyenne
|
4 sept. 2026 |
| CVE-2026-84947 |
undici's dump interceptor reads and discards a response body up to a configurable maximum size
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-84961 |
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and…
|
7.4
Élevée
|
4 sept. 2026 |
| CVE-2026-85008 |
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by…
|
3.7
Faible
|
4 sept. 2026 |
| CVE-2026-85152 |
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate…
|
7.4
Élevée
|
4 sept. 2026 |
| CVE-2026-85014 |
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP…
|
5.9
Moyenne
|
4 sept. 2026 |