0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2158 more potentially affected by CVE-2026-16729 via undici (>=6.0.0, <=6.27.0)

🗓️ 29 Jul 2026 19:44:57Reported by Vulners OSVType

vulnersosv🔗 security.snyk.io👁 8 Views

undici NPM package versions 6.0.0 to 6.27.0 vulnerable to CVE-2026-16729 with 2167+ affected packages.

Reporter	Title	Published	Views	Family All 183
IBM Security Bulletins	Security Bulletin: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher	9 Sep 202620:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697.	7 Sep 202605:22	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	8 Sep 202617:18	–	ibm
ATTACKERKB	CVE-2026-16729	29 Jul 202616:45	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)	18 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	18 Aug 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-16729	29 Jul 202600:00	–	nessus
Amazon	Important: nodejs24	17 Aug 202600:00	–	amazon
Amazon	Important: nodejs22	17 Aug 202600:00	–	amazon
Chainguard	CVE-2026-16729 vulnerabilities	4 Aug 202614:17	–	cgr

06 Aug 2026 08:13Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.14.8 - 6.5

EPSS0.00191

SSVC

undici npm CVE-2026-16729 transitive dependency DoS HTTP Node.js