undici vulnerabilities
An HTTP/1.1 client, written from scratch for Node.js
- Registry
- npm
- Latest
- 8.12.3
- License
- MIT
46 known advisories
The latest version, 8.12.3, is not affected by any of them. Projects on older versions may be.
npm install undici@8.12.3Security advisories for undici
undici vulnerable to Denial of Service via orphaned RetryHandler response body
- Affected
- >=7.11.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to downstream response splitting via retry interceptor
- Affected
- <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- Affected
- >=6.7.0 <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
- Affected
- >=7.15.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
- Affected
- >=7.1.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
- Affected
- >=7.24.1 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to caching and replay of unsafe HTTP method responses
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
- Affected
- >=8.10.0 <8.10.2
- Fixed in
- 8.10.2
undici vulnerable to Denial of Service via WebSocketStream unclean close
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
- Affected
- >=6.25.0 <6.28.1 · >=7.28.0 <7.29.1 · >=8.1.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
- Affected
- >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 7.29.0, 8.9.0
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to downstream response desynchronization via retry interceptor
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- Affected
- >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 7.29.0, 8.9.0
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via fragment count bypass
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
- Affected
- >=7.23.0 <7.28.0 · >=8.0.0 <8.2.0
- Fixed in
- 7.28.0, 8.2.0
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
- Affected
- >=7.23.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 7.28.0, 8.5.0
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
- Affected
- >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
- Affected
- >=8.0.0 <8.5.0
- Fixed in
- 8.5.0
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has CRLF Injection in undici via `upgrade` option
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
- Affected
- >=7.17.0 <7.24.0
- Fixed in
- 7.24.0
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
- Affected
- >=6.0.0 <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has an HTTP Request/Response Smuggling issue
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
- Affected
- >=7.0.0 <7.18.2 · <6.23.0
- Fixed in
- 6.23.0, 7.18.2
undici Denial of Service attack via bad certificate data
- Affected
- <5.29.0 · >=6.0.0 <6.21.2 · >=7.0.0 <7.5.0
- Fixed in
- 5.29.0, 6.21.2, 7.5.0
Use of Insufficiently Random Values in undici
- Affected
- >=4.5.0 <5.28.5 · >=6.0.0 <6.21.1 · >=7.0.0 <7.2.3
- Fixed in
- 5.28.5, 6.21.1, 7.2.3
Undici vulnerable to data leak when using response.arrayBuffer()
- Affected
- >=6.14.0 <6.19.2
- Fixed in
- 6.19.2
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
- Affected
- <5.28.4 · >=6.0.0 <6.11.1
- Fixed in
- 5.28.4, 6.11.1
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
- Affected
- <5.28.4 · >=6.0.0 <6.11.1
- Fixed in
- 5.28.4, 6.11.1
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
- Affected
- <5.28.3 · >=6.0.0 <6.6.1
- Fixed in
- 5.28.3, 6.6.1
fetch(url) leads to a memory leak in undici
- Affected
- >=6.0.0 <6.6.1
- Fixed in
- 6.6.1
Undici's cookie header not cleared on cross-origin redirect in fetch
- Affected
- <5.26.2
- Fixed in
- 5.26.2
CRLF Injection in Nodejs ‘undici’ via host
- Affected
- >=2.0.0 <5.19.1
- Fixed in
- 5.19.1
Regular Expression Denial of Service in Headers
- Affected
- <5.19.1
- Fixed in
- 5.19.1
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
- Affected
- <5.8.2
- Fixed in
- 5.8.2
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
- Affected
- <5.8.2
- Fixed in
- 5.8.2
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
- Affected
- <5.8.0
- Fixed in
- 5.8.0
undici before v5.8.0 vulnerable to CRLF injection in request headers
- Affected
- <5.8.0
- Fixed in
- 5.8.0
ProxyAgent vulnerable to MITM
- Affected
- >=4.8.2 <5.5.1
- Fixed in
- 5.5.1
Which of your client projects still run an old undici?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.