nodejs undici vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20233
3. 20245
4. 20252
5. 20261

Newest CVEs

• CVE-2026-22036

  Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

  nodejs · undici

  Medium5.9
• CVE-2025-47279

  undici Denial of Service attack via bad certificate data

  nodejs · undici

  Low3.1
• CVE-2025-22150

  Undici Uses Insufficiently Random Values

  nodejs · undici

  Medium6.8
• CVE-2024-38372

  Undici vulnerable to data leak when using response.arrayBuffer()

  nodejs · undici

  Low2.0
• CVE-2024-30260

  Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

  nodejs · undici

  Low3.9
• CVE-2024-30261

  Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

  nodejs · undici

  Low2.6
• CVE-2024-24750

  Backpressure request ignored in fetch() in Undici

  nodejs · undici

  Medium6.5
• CVE-2024-24758

  Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

  nodejs · undici

  Low3.9
• CVE-2023-45143

  Undici's cookie header not cleared on cross-origin redirect in fetch

  nodejs · undici

  Low3.9
• CVE-2023-23936

  CRLF Injection in Nodejs ‘undici’ via host

  nodejs · undici

  Medium6.5