UN
Product
undici
55
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 6High 21Medium 21Low 7
Watch
Add undici to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6733 | 3.7 | Jun 17 | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse Affected: before 6.27.0; 7.0.0 before 7.28.0; 8.0.0 before 8.5.0 |
| CVE-2024-30261 | 3.5 | Apr 4 | Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect Affected: >= 6.0.0, < 6.11.1; < 5.28.4 |
| CVE-2023-45143 | 3.5 | Oct 12 | Undici's cookie header not cleared on cross-origin redirect in fetch Affected: < 5.26.2 |
| CVE-2025-47279 | 3.1 | May 15 | undici Denial of Service attack via bad certificate data Affected: < 5.29.0; >= 6.0.0, < 6.21.2; >= 7.0.0, < 7.5.0 |
| CVE-2024-38372 | 2.0 | Jul 8 | Undici vulnerable to data leak when using response.arrayBuffer() Affected: >= 6.14.0, < 6.19.2 |