Known vulnerabilities in undici

Vendor: Node.js
Software: undici
Software CPE: cpe:2.3:a:nodejs:undici:*:*:*:*:*:nodejs:*:*
Total vulnerabilities: 27
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting undici undici is affected by 27 known vulnerabilities: 20 medium, 7 low Critical High Medium Low

Vulnerabilities (27)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140036 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-16729
CWE-74 Medium
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
#VU140035 - Use of Web Browser Cache Containing Sensitive Information
CVE-2026-13697
CWE-525 Medium
No
No
7.29.0, 8.9.0 29.07.2026 SB2026072967
#VU140034 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-16728
CWE-444 Medium
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
#VU140033 - Interpretation Conflict
CVE-2026-14643
CWE-436 Medium
No
No
7.29.0, 8.9.0 29.07.2026 SB2026072967
#VU140032 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-15157
CWE-93 Low
No
No
6.28.0, 7.29.0, 8.9.0 29.07.2026 SB2026072967
#VU134758 - Origin Validation Error
CVE-2026-6734
CWE-346 Low
No
No
7.26.0, 8.2.0 17.06.2026 SB2026061761
#VU134757 - Resource exhaustion
CVE-2026-9675
CWE-400 Medium
No
No
8.5.0 17.06.2026 SB2026061760
#VU134756 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-9679
CWE-93 Medium
No
No
6.26.0, 7.28.0, 8.5.0 17.06.2026 SB2026061760
#VU134755 - Use of Cache Containing Sensitive Information
CVE-2026-9678
CWE-524 Medium
No
No
7.28.0, 8.5.0 17.06.2026 SB2026061760
#VU134754 - Improper Certificate Validation
CVE-2026-9697
CWE-295 Medium
No
No
7.28.0, 8.5.0 17.06.2026 SB2026061760
SB20260720393
#VU134753 - Allocation of Resources Without Limits or Throttling
CVE-2026-12151
CWE-770 Medium
No
No
6.26.0, 7.28.0, 8.5.0 17.06.2026 SB2026061760
SB20260720393
#VU134752 - Permissive List of Allowed Inputs
CVE-2026-11525
CWE-183 Low
No
No
7.28.0, 8.5.0 17.06.2026 SB2026061760
#VU134751 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-6733
CWE-367 Low
No
No
6.26.0, 7.28.0, 8.5.0 17.06.2026 SB2026061760
#VU109244 - Missing release of memory after effective lifetime
CVE-2025-47279
CWE-401 Medium
No
No
5.29.0, 6.21.2, 7.5.0 16.05.2025 SB2025051606
SB2025052019
SB2025090104
and 5 more
#VU103227 - Use of Insufficiently Random Values
CVE-2025-22150
CWE-330 Medium
No
No
5.28.5, 6.21.1, 7.2.3 22.01.2025 SB2025012259
SB2025012439
SB2025012440
and 26 more
#VU93884 - Missing release of memory after effective lifetime
CVE-2024-38372
CWE-401 Medium
No
No
6.19.2 09.07.2024 SB2024070938
SB2024082714
SB2025032026
and 1 more
#VU88178 - Insufficient Verification of Data Authenticity
CVE-2024-30261
CWE-345 Medium
No
No
5.28.4, 6.11.1 05.04.2024 SB2024040527
SB2024041611
SB2024041618
and 12 more
#VU88177 - Exposure of sensitive information to an unauthorized actor
CVE-2024-30260
CWE-200 Low
No
No
5.28.4, 6.11.1 05.04.2024 SB2024040527
SB2024041611
SB2024041618
and 11 more
#VU86710 - Resource exhaustion
CVE-2024-24750
CWE-400 Medium
No
No
6.6.1 22.02.2024 SB2024022211
SB2024052127
#VU86709 - Exposure of sensitive information to an unauthorized actor
CVE-2024-24758
CWE-200 Low
No
No
5.28.3, 6.6.1 22.02.2024 SB2024022211
SB2024022225
SB2024022832
and 13 more


Showing elements 1 - 20 out of 27