CVE Tools
Track your stack

Undici

62 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Undici, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Undici CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Undici CVEs per month
MonthCVEs
2024-120
2025-011
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-036
2026-040
2026-050
2026-068
2026-075
2026-080
2026-0911
2026-109
2026-116

Severity

How the 62 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High1829%
  • Medium3252%
  • Low1219%

Latest CVEs

The 15 most recently published vulnerabilities affecting Undici.

  1. CVE-2026-116630undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation5.9
  2. CVE-2026-120415undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping5.9
  3. CVE-2026-120423undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata5.9
  4. CVE-2026-116592undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops7.4
  5. CVE-2026-120222undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay5.9
  6. CVE-2026-120474undici vulnerable to cross-user cache disclosure via same-origin redirect6.5
  7. CVE-2026-87029undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor5.9
  8. CVE-2026-109932undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering5.9
  9. CVE-2026-87018undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation7.5
  10. CVE-2026-109383undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent7.4
  11. CVE-2026-109829undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects7.4
  12. CVE-2026-109841undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens5.9
  13. CVE-2026-109924undici vulnerable to Denial of Service via unbounded memory in the EventSource parser5.9
  14. CVE-2026-109869undici vulnerable to Denial of Service via unhandled error on excessive content-encodings7.5
  15. CVE-2026-109855undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake7.5

Product grouping is registry-driven, with AI assist and human review. How it works