CVE-2026-120222

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

CVE-2026-120222

The undici HTTP client for Node.js versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 is vulnerable to a Denial of Service (DoS) condition. When the cache interceptor is used with a downstream handler that throws during response processing (e.g., the built-in dump interceptor exceeding maxSiz...

EUVD-2026-118179

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

CVE-2026-120222: undici: undici is an HTTP client for Node.js

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

Security Bulletin: Vulnerability in undici affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in undici has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabilit...

CLEANSTART-2026-MB00933 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive

Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...

CLEANSTART-2026-NE99679 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles malformed Cache-Control private directives...

CLEANSTART-2026-IA13045 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...

Security vulnerability affects the renovate package. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never...

CLEANSTART-2026-XT43376 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the renovate package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

CLEANSTART-2026-IU46209 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...

CLEANSTART-2026-OB41556 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...

CVE-2026-85008 affects multiple packages. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the...

CLEANSTART-2026-HS02762 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the renovate package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

PT-2026-132950

Security vulnerability affects the renovate package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

SUSE CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CLEANSTART-2026-WF83239 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the n8n package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

PT-2026-117893

Security vulnerability affects the n8n package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

CLEANSTART-2026-BT10409 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...

CVE-2026-85008 affects multiple packages. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the...

CLEANSTART-2026-VO74481 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

CVE-2026-84933 affects multiple packages. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. See references for individual vulnerability details...