Known vulnerabilities in undici

Vendor: Node.js
Software: undici
Software CPE: cpe:2.3:a:nodejs:undici:*:*:*:*:*:nodejs:*:*
Total vulnerabilities: 44
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting undici undici is affected by 44 known vulnerabilities: 33 medium, 11 low Critical High Medium Low

Vulnerabilities (44)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147181 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-18540
CWE-444 Low
No
No
6.28.1, 7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147180 - Uncaught Exception
CVE-2026-19534
CWE-248 Medium
No
No
6.28.1, 7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147179 - Allocation of Resources Without Limits or Throttling
CVE-2026-84890
CWE-770 Medium
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147178 - Use of Cache Containing Sensitive Information
CVE-2026-84933
CWE-524 Medium
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147177 - Improper input validation
CVE-2026-84947
CWE-20 Low
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147176 - Improper Certificate Validation
CVE-2026-84961
CWE-295 Medium
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147175 - Insufficient Verification of Data Authenticity
CVE-2026-85008
CWE-345 Low
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147174 - Origin Validation Error
CVE-2026-85152
CWE-346 Medium
No
No
8.10.2 06.09.2026 SB2026090617
#VU147173 - Uncaught Exception
CVE-2026-85014
CWE-248 Medium
No
No
7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU147172 - Uncaught Exception
CVE-2026-85024
CWE-248 Medium
No
No
6.28.1, 7.29.1, 8.10.2 06.09.2026 SB2026090617
#VU140036 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-16729
CWE-74 Medium
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
SB2026090821
SB2026091015
and 1 more
#VU140035 - Use of Web Browser Cache Containing Sensitive Information
CVE-2026-13697
CWE-525 Medium
No
No
7.29.0, 8.9.0 29.07.2026 SB2026072967
SB2026090821
SB2026091015
#VU140034 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-16728
CWE-444 Medium
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
SB2026090821
SB2026091015
and 1 more
#VU140033 - Interpretation Conflict
CVE-2026-14643
CWE-436 Medium
No
No
7.29.0, 8.9.0 29.07.2026 SB2026072967
SB2026090821
SB2026091015
#VU140032 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-15157
CWE-93 Low
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
SB2026090821
SB2026091015
and 1 more
#VU134758 - Origin Validation Error
CVE-2026-6734
CWE-346 Low
No
No
7.26.0, 8.2.0 17.06.2026 SB2026061761
SB2026082715
SB20260831117
and 3 more
#VU134757 - Resource exhaustion
CVE-2026-9675
CWE-400 Medium
No
No
8.5.0 17.06.2026 SB2026061760
SB2026090726
#VU134756 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-9679
CWE-93 Medium
No
No
6.26.0, 7.28.0, 8.5.0 17.06.2026 SB2026061760
SB2026080430
SB2026082715
and 2 more
#VU134755 - Use of Cache Containing Sensitive Information
CVE-2026-9678
CWE-524 Medium
No
No
7.28.0, 8.5.0 17.06.2026 SB2026061760
SB2026082715
SB20260831117
and 6 more
#VU134752 - Permissive List of Allowed Inputs
CVE-2026-11525
CWE-183 Low
No
No
7.28.0, 8.5.0 17.06.2026 SB2026061760
SB2026080430
SB2026082715
and 6 more


Showing elements 1 - 20 out of 44