Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners on the zlib InflateRaw object, removing the error listener while the...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache and interceptors.deduplicate interceptors, which build cache and deduplication keys without t...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and then discards t...

Insufficient Verification of Data Authenticity

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the interceptors.cache interceptor, whose skip-list construction subtracts the configured methods from the safe-method s...

Improper Certificate Validation

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parseJSON.stringify... and thereby...

Use of Persistent Cookies Containing Sensitive Information

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores responses without...

Use of Persistent Cookies Containing Sensitive Information

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores response...

Numeric Truncation Error

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but...

HTTP Request Smuggling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body, so the delivere...

HTTP Request Smuggling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body,...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol head...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress interceptor, which caps the decompression chain at 5 layers but does not bound the tot...

Missing Release of Resource after Effective Lifetime

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request...

CVE-2026-84947

A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection...

CVE-2026-85024

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...

CVE-2026-85014

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

AZL-99939 CVE-2026-18540 affecting package nodejs 24.21.0-1

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

AZL-99942 CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...