Product by NodeJS
Nodejs undici
55 known vulnerabilities in Nodejs undici (NodeJS), 0 of them actively exploited (CISA KEV).
Key figures
55
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-1526 | Undici: Improper Handling of Highly Compressed Data (Data Amplification) | 7.5 | |
| High | CVE-2026-12151 | undici WebSocket client vulnerable to denial of service via fragment count bypass | 7.5 | |
| High | CVE-2026-2229 | Undici: Uncaught Exception | 7.5 | |
| High | CVE-2023-24807 | Undici vulnerable to Regular Expression Denial of Service in Headers | 7.5 | |
| Critical | CVE-2022-35949 | `undici.request` vulnerable to SSRF using absolute URL on `pathname` | 5.3 | |
| Critical | CVE-2026-13697 | Undici: Use of Web Browser Cache Containing Sensitive Information | 7.4 | |
| High | CVE-2026-109869 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | 7.5 | |
| High | CVE-2026-19534 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol | 7.5 | |
| Medium | CVE-2022-31150 | CRLF injection in request headers | 5.3 | |
| High | CVE-2026-109855 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake | 7.5 | |
| Medium | CVE-2023-23936 | CRLF Injection in Nodejs ‘undici’ via host | 6.5 | |
| Medium | CVE-2026-18149 | undici vulnerable to Denial of Service via orphaned RetryHandler response body | 5.9 | |
| High | CVE-2026-9697 | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent | 7.4 | |
| Medium | CVE-2022-35948 | CRLF Injection in Nodejs ‘undici’ via Content-Type | 5.3 | |
| High | CVE-2026-87018 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | 7.5 | |
| High | CVE-2026-1528 | Undici: Uncaught Exception | 7.5 | |
| Critical | CVE-2026-109383 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent | 7.4 | |
| High | CVE-2026-9675 | undici WebSocket client vulnerable to denial of service via cumulative fragment bypass | 7.5 | |
| Critical | CVE-2026-109829 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | 7.4 | |
| Medium | CVE-2025-22150 | Undici Uses Insufficiently Random Values | 6.8 | |
| Medium | CVE-2026-84890 | undici vulnerable to Denial of Service via unbounded decompression of compressed responses | 5.9 | |
| Medium | CVE-2026-85024 | Undici: Uncaught Exception | 5.9 | |
| High | CVE-2026-109932 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering | 5.9 | |
| High | CVE-2026-109924 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser | 5.9 | |
| Low | CVE-2023-45143 | Undici's cookie header not cleared on cross-origin redirect in fetch | 3.9 |