undici (npm)
An HTTP/1.1 client, written from scratch for Node.js
Advisories
214
Latest version
8.12.3
Released Oct 19, 2026
License
MIT
OpenSSF Scorecard
8.1 / 10
How to fix
Upgrading to 8.12.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install undici@8.12.3yarn
yarn add undici@8.12.3pnpm
pnpm add undici@8.12.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
High EPSS 0.26% |
>= 7.15.0, < 7.30.1 | 7.30.1 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
High EPSS 0.26% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
High EPSS 0.26% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
High EPSS 0.26% |
>= 7.15.0, < 7.30.1 | 7.30.1 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 4.2.1, < 6.29.1 | 6.29.1 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
High EPSS 0.19% |
>= 4.2.1, < 6.29.1 | 6.29.1 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 5.15.0, < 6.29.1 | 6.29.1 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 5.15.0, < 6.29.1 | 6.29.1 |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
High EPSS 0.32% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 6.5.0, < 6.29.1 | 6.29.1 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
High EPSS 0.32% |
>= 6.5.0, < 6.29.1 | 6.29.1 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 6.23.0, < 6.29.1 | 6.29.1 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 6.23.0, < 6.29.1 | 6.29.1 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 7.18.0, < 7.30.1 | 7.30.1 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
High EPSS 0.34% |
>= 7.18.0, < 7.30.1 | 7.30.1 |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
High EPSS 0.25% |
>= 7.15.0, < 7.30.1 | 7.30.1 |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
High EPSS 0.25% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
High EPSS 0.25% |
>= 7.15.0, < 7.30.1 | 7.30.1 |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
High EPSS 0.25% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
Critical EPSS 0.15% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
Critical EPSS 0.15% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
Critical EPSS 0.15% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
Critical EPSS 0.15% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 4.0.0, < 6.29.1 | 6.29.1 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 7.0.0, < 7.30.1 | 7.30.1 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 8.0.0, < 8.12.2 | 8.12.2 |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
Critical EPSS 0.18% |
>= 4.0.0, < 6.29.1 | 6.29.1 |
| GHSA-qq8j-7v2v-3rwp undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake |
High EPSS 0.28% |
>= 8.11.0, < 8.11.2 | 8.11.2 |
| GHSA-qq8j-7v2v-3rwp undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake |
High EPSS 0.28% |
>= 8.11.0, < 8.11.2 | 8.11.2 |
| GHSA-3xpg-4rpp-hhhm undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
Medium EPSS 0.41% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-3xpg-4rpp-hhhm undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
Medium EPSS 0.41% |
>= 7.15.0, < 7.29.1 | 7.29.1 |
| GHSA-3xpg-4rpp-hhhm undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
Medium EPSS 0.41% |
>= 7.15.0, < 7.29.1 | 7.29.1 |
| GHSA-3xpg-4rpp-hhhm undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
Medium EPSS 0.41% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 6.7.0, < 6.28.1 | 6.28.1 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 6.7.0, < 6.28.1 | 6.28.1 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
High EPSS 0.39% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
< 6.28.1 | 6.28.1 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor |
Low EPSS 0.31% |
< 6.28.1 | 6.28.1 |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body |
Medium EPSS 0.48% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body |
Medium EPSS 0.48% |
>= 7.11.0, < 7.29.1 | 7.29.1 |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body |
Medium EPSS 0.48% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body |
Medium EPSS 0.48% |
>= 7.11.0, < 7.29.1 | 7.29.1 |
| GHSA-vp8m-p9jh-q5pm undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors |
High EPSS 0.16% |
>= 8.10.0, < 8.10.2 | 8.10.2 |
| GHSA-vp8m-p9jh-q5pm undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors |
High EPSS 0.16% |
>= 8.10.0, < 8.10.2 | 8.10.2 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 6.25.0, < 6.28.1 | 6.28.1 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 8.1.0, < 8.10.2 | 8.10.2 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 7.28.0, < 7.29.1 | 7.29.1 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 8.1.0, < 8.10.2 | 8.10.2 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 6.25.0, < 6.28.1 | 6.28.1 |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
Medium EPSS 0.41% |
>= 7.28.0, < 7.29.1 | 7.29.1 |
| GHSA-rx4f-c7p8-82vq undici vulnerable to Denial of Service via WebSocketStream unclean close |
High EPSS 0.37% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-rx4f-c7p8-82vq undici vulnerable to Denial of Service via WebSocketStream unclean close |
High EPSS 0.37% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-rx4f-c7p8-82vq undici vulnerable to Denial of Service via WebSocketStream unclean close |
High EPSS 0.37% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-rx4f-c7p8-82vq undici vulnerable to Denial of Service via WebSocketStream unclean close |
High EPSS 0.37% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-8436-99hf-9mmv undici vulnerable to caching and replay of unsafe HTTP method responses |
Medium EPSS 0.12% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-8436-99hf-9mmv undici vulnerable to caching and replay of unsafe HTTP method responses |
Medium EPSS 0.12% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-8436-99hf-9mmv undici vulnerable to caching and replay of unsafe HTTP method responses |
Medium EPSS 0.12% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-8436-99hf-9mmv undici vulnerable to caching and replay of unsafe HTTP method responses |
Medium EPSS 0.12% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-w293-vg96-wgc3 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
Critical EPSS 0.18% |
>= 7.24.1, < 7.29.1 | 7.29.1 |
| GHSA-w293-vg96-wgc3 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
Critical EPSS 0.18% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-w293-vg96-wgc3 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
Critical EPSS 0.18% |
>= 7.24.1, < 7.29.1 | 7.29.1 |
| GHSA-w293-vg96-wgc3 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
Critical EPSS 0.18% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-2gqq-gqf2-x968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
Medium EPSS 0.20% |
>= 7.1.0, < 7.29.1 | 7.29.1 |
| GHSA-2gqq-gqf2-x968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
Medium EPSS 0.20% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-2gqq-gqf2-x968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
Medium EPSS 0.20% |
>= 7.1.0, < 7.29.1 | 7.29.1 |
| GHSA-2gqq-gqf2-x968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
Medium EPSS 0.20% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-2jfj-6hjv-fm6j undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
High EPSS 0.30% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-2jfj-6hjv-fm6j undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
High EPSS 0.30% |
>= 7.0.0, < 7.29.1 | 7.29.1 |
| GHSA-2jfj-6hjv-fm6j undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
High EPSS 0.30% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-2jfj-6hjv-fm6j undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
High EPSS 0.30% |
>= 8.0.0, < 8.10.2 | 8.10.2 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
< 6.28.0 | 6.28.0 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
< 6.28.0 | 6.28.0 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property |
Medium EPSS 0.26% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-jr45-8vmc-qm54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
High EPSS 0.40% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-jr45-8vmc-qm54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
High EPSS 0.40% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-jr45-8vmc-qm54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
High EPSS 0.40% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-jr45-8vmc-qm54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
High EPSS 0.40% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
< 6.28.0 | 6.28.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor |
Medium EPSS 0.29% |
< 6.28.0 | 6.28.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
< 6.28.0 | 6.28.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
< 6.28.0 | 6.28.0 |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
Medium EPSS 0.28% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
Critical EPSS 0.57% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
Critical EPSS 0.57% |
>= 7.0.0, < 7.29.0 | 7.29.0 |
| GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
Critical EPSS 0.57% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
Critical EPSS 0.57% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
High EPSS 0.46% |
>= 7.23.0, < 7.28.0 | 7.28.0 |
| GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
High EPSS 0.46% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
High EPSS 0.46% |
>= 7.23.0, < 7.28.0 | 7.28.0 |
| GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
High EPSS 0.46% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
< 6.27.0 | 6.27.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
< 6.27.0 | 6.27.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
Medium EPSS 0.26% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
Medium EPSS 0.39% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
Medium EPSS 0.39% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
Medium EPSS 0.39% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
Medium EPSS 0.39% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
High EPSS 0.34% |
>= 7.23.0, < 7.28.0 | 7.28.0 |
| GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
High EPSS 0.34% |
>= 8.0.0, < 8.2.0 | 8.2.0 |
| GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
High EPSS 0.34% |
>= 7.23.0, < 7.28.0 | 7.28.0 |
| GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
High EPSS 0.34% |
>= 8.0.0, < 8.2.0 | 8.2.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
< 6.27.0 | 6.27.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
< 6.27.0 | 6.27.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
Low EPSS 0.22% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
< 6.27.0 | 6.27.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
< 6.27.0 | 6.27.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
Low EPSS 0.24% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-38rv-x7px-6hhq undici WebSocket client vulnerable to denial of service via cumulative fragment bypass |
High EPSS 0.43% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-38rv-x7px-6hhq undici WebSocket client vulnerable to denial of service via cumulative fragment bypass |
High EPSS 0.43% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
>= 8.0.0, < 8.5.0 | 8.5.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
>= 7.0.0, < 7.28.0 | 7.28.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
< 6.27.0 | 6.27.0 |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass |
High EPSS 0.79% |
< 6.27.0 | 6.27.0 |
| GHSA-phc3-fgpg-7m6h Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS |
Medium EPSS 0.59% |
>= 7.17.0, < 7.24.0 | 7.24.0 |
| GHSA-phc3-fgpg-7m6h Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS |
Medium EPSS 0.59% |
>= 7.17.0, < 7.24.0 | 7.24.0 |
| GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation |
High EPSS 0.91% |
< 6.24.0 | 6.24.0 |
| GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation |
High EPSS 0.91% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation |
High EPSS 0.91% |
< 6.24.0 | 6.24.0 |
| GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation |
High EPSS 0.91% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client |
High EPSS 0.51% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client |
High EPSS 0.51% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client |
High EPSS 0.51% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client |
High EPSS 0.51% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option |
Medium EPSS 0.29% |
< 6.24.0 | 6.24.0 |
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option |
Medium EPSS 0.29% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option |
Medium EPSS 0.29% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option |
Medium EPSS 0.29% |
< 6.24.0 | 6.24.0 |
| GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression |
High EPSS 1.20% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression |
High EPSS 1.20% |
< 6.24.0 | 6.24.0 |
| GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression |
High EPSS 1.20% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression |
High EPSS 1.20% |
< 6.24.0 | 6.24.0 |
| GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue |
Critical EPSS 0.52% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue |
Critical EPSS 0.52% |
< 6.24.0 | 6.24.0 |
| GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue |
Critical EPSS 0.52% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue |
Critical EPSS 0.52% |
< 6.24.0 | 6.24.0 |
| GHSA-g9mf-h72j-4rw9 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion |
High EPSS 0.46% |
< 6.23.0 | 6.23.0 |
| GHSA-g9mf-h72j-4rw9 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion |
High EPSS 0.46% |
>= 7.0.0, < 7.18.2 | 7.18.2 |
| GHSA-g9mf-h72j-4rw9 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion |
High EPSS 0.46% |
< 6.23.0 | 6.23.0 |
| GHSA-g9mf-h72j-4rw9 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion |
High EPSS 0.46% |
>= 7.0.0, < 7.18.2 | 7.18.2 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
< 5.29.0 | 5.29.0 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
>= 7.0.0, < 7.5.0 | 7.5.0 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
>= 6.0.0, < 6.21.2 | 6.21.2 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
< 5.29.0 | 5.29.0 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
>= 7.0.0, < 7.5.0 | 7.5.0 |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data |
Low EPSS 0.34% |
>= 6.0.0, < 6.21.2 | 6.21.2 |
| GHSA-c76h-2ccp-4975 Use of Insufficiently Random Values in undici |
Medium EPSS 0.76% |
>= 6.0.0, < 6.21.1 | 6.21.1 |
| GHSA-c76h-2ccp-4975 Use of Insufficiently Random Values in undici |
Medium EPSS 0.76% |
>= 7.0.0, < 7.2.3 | 7.2.3 |
| GHSA-c76h-2ccp-4975 Use of Insufficiently Random Values in undici |
Medium EPSS 0.76% |
>= 4.5.0, < 5.28.5 | 5.28.5 |
| GHSA-3g92-w8c5-73pq Undici vulnerable to data leak when using response.arrayBuffer() |
Low EPSS 0.47% |
>= 6.14.0, < 6.19.2 | 6.19.2 |
| GHSA-9qxr-qj54-h672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect |
Low EPSS 0.80% |
< 5.28.4 | 5.28.4 |
| GHSA-9qxr-qj54-h672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect |
Low EPSS 0.80% |
>= 6.0.0, < 6.11.1 | 6.11.1 |
| GHSA-9qxr-qj54-h672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect |
Low EPSS 0.80% |
< 5.28.4 | 5.28.4 |
| GHSA-9qxr-qj54-h672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect |
Low EPSS 0.80% |
>= 6.0.0, < 6.11.1 | 6.11.1 |
| GHSA-m4v8-wqvr-p9f7 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline |
Medium EPSS 0.73% |
< 5.28.4 | 5.28.4 |
| GHSA-m4v8-wqvr-p9f7 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline |
Medium EPSS 0.73% |
>= 6.0.0, < 6.11.1 | 6.11.1 |
| GHSA-m4v8-wqvr-p9f7 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline |
Medium EPSS 0.73% |
< 5.28.4 | 5.28.4 |
| GHSA-m4v8-wqvr-p9f7 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline |
Medium EPSS 0.73% |
>= 6.0.0, < 6.11.1 | 6.11.1 |
| GHSA-3787-6prv-h9w3 Undici proxy-authorization header not cleared on cross-origin redirect in fetch |
Medium EPSS 0.77% |
>= 6.0.0, < 6.6.1 | 6.6.1 |
| GHSA-3787-6prv-h9w3 Undici proxy-authorization header not cleared on cross-origin redirect in fetch |
Medium EPSS 0.77% |
< 5.28.3 | 5.28.3 |
| GHSA-3787-6prv-h9w3 Undici proxy-authorization header not cleared on cross-origin redirect in fetch |
Medium EPSS 0.77% |
>= 6.0.0, <= 6.6.0 | No fix yet |
| GHSA-3787-6prv-h9w3 Undici proxy-authorization header not cleared on cross-origin redirect in fetch |
Medium EPSS 0.77% |
<= 5.28.2 | No fix yet |
| GHSA-9f24-jqhm-jfcw fetch(url) leads to a memory leak in undici |
Medium EPSS 0.70% |
>= 6.0.0, <= 6.6.0 | No fix yet |
| GHSA-9f24-jqhm-jfcw fetch(url) leads to a memory leak in undici |
Medium EPSS 0.70% |
>= 6.0.0, < 6.6.1 | 6.6.1 |
| GHSA-wqq4-5wpv-mx2g Undici's cookie header not cleared on cross-origin redirect in fetch |
Low EPSS 1.37% |
< 5.26.2 | 5.26.2 |
| GHSA-r6ch-mqf9-qc9w Regular Expression Denial of Service in Headers |
High EPSS 1.31% |
< 5.19.1 | 5.19.1 |
| GHSA-5r9g-qh6m-jxff CRLF Injection in Nodejs ‘undici’ via host |
Medium EPSS 1.13% |
>= 2.0.0, < 5.19.1 | 5.19.1 |
| GHSA-f772-66g8-q5h3 Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type |
Medium EPSS 1.39% |
< 5.8.2 | 5.8.2 |
| GHSA-8qr4-xgw6-wmr3 `undici.request` vulnerable to SSRF using absolute URL on `pathname` |
Critical EPSS 1.93% |
< 5.8.2 | 5.8.2 |
| GHSA-q768-x9m6-m9qp undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect |
Medium EPSS 1.37% |
< 5.8.0 | 5.8.0 |
| GHSA-3cvr-822r-rqcc undici before v5.8.0 vulnerable to CRLF injection in request headers |
Medium EPSS 1.52% |
< 5.8.0 | 5.8.0 |
| GHSA-pgw7-wx7w-2w33 ProxyAgent vulnerable to MITM |
Medium EPSS 0.47% |
>= 4.8.2, < 5.5.1 | 5.5.1 |
Source: git+https://github.com/nodejs/undici.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor