Undici

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. An attacker who controls the type value can append arbitrary HTTP headers to the outgoing request, potentially smuggling a second request past an upstream proxy or server. No public exploit identified at time of analysis and KEV status is not confirmed in the provided data.

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from a shared cache to subsequent callers, including unauthenticated ones, when the upstream origin sends qualified `no-cache` or `private` Cache-Control directives with optional whitespace (OWS) around the `=` delimiter. Affected deployments are those explicitly running undici 7.0.0-7.28.x or 8.0.0-8.8.x with `interceptors.cache()` in shared mode while forwarding `Authorization` headers upstream. This is a bypass of the earlier CVE-2026-9678 fix; a public proof-of-concept exists and vendor-released patches are available in undici 7.29.0 and 8.9.0.

Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions 7.0.0-7.28.x and 8.0.0-8.8.x when the interceptor runs in shared mode (the default). A response bearing a degenerate qualified private directive (e.g. private="") slips past the shared-cache guard and is later served to a different caller sharing the same cache key, leaking private bodies and headers including Set-Cookie; separately, mixing an unqualified and a qualified private directive throws an uncaught TypeError that can crash the process. No public exploit identified at time of analysis, and EPSS is low (0.27%), but the fix is confirmed in undici 7.29.0 and 8.9.0.

SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.

Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream server to inject unsolicited HTTP responses onto idle keep-alive sockets, causing subsequent outbound requests to receive falsified responses. All Undici versions across the v6, v7, and v8 branches prior to the patched releases are affected when keep-alive connection reuse is active (the default). While the CVSS score is low (3.7) and no public exploit or KEV listing exists, the integrity impact can carry significant business logic consequences in applications that proxy requests through third-party or partially trusted upstream servers.

Cache information disclosure in Undici's shared-mode cache interceptor allows a prior authenticated user's HTTP response to be served to a subsequent, potentially unauthenticated, caller. Applications using Undici's explicit `interceptors.cache()` in shared mode that forward Authorization headers to an upstream which returns Cache-Control headers with whitespace-padded qualified directives (e.g., `private=" authorization"`) are affected across all v7 versions prior to 7.28.0 and all v8 versions prior to 8.5.0. No public exploit has been identified at time of analysis; exploitation is bounded by high attack complexity (CVSS AC:H, score 5.9), but when conditions align, the confidentiality impact is complete.

HTTP response header injection in undici's cookie parser exposes proxy, middleware, and SSR framework applications to session fixation, open redirect, and cache poisoning. The `parseSetCookie`, `parseCookie`, and `getSetCookies` functions incorrectly percent-decode cookie values using `qsUnescape`, converting encoded sequences such as `%0D%0A` into literal CRLF bytes in violation of RFC 6265 §5.4, which prescribes no such decoding. Any application that fetches from an attacker-controlled upstream and forwards the parsed cookie value into a downstream response header is exploitable; no public exploit has been identified at time of analysis, and patched releases v6.26.0, v7.28.0, and v8.5.0 are available.

TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0) causes the library to reuse a single SOCKS5 connection pool bound to the first-seen origin for every subsequent origin, so credentials and request bodies destined for origin B are silently sent to and trusted from origin A, and HTTPS targets may be downgraded to HTTP. Any Node.js application using Socks5ProxyAgent (directly or via setGlobalDispatcher) that contacts more than one origin is exposed. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and EPSS is very low (0.15%, 4th percentile), but the GHSA advisory ships a regression test demonstrating the misrouting.

Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior to 8.5.0 allows a malicious or compromised WebSocket server to exhaust client memory by streaming many small fragmented frames that individually pass the per-frame maxPayloadSize check but cumulatively bypass any size limit. The flaw is a regression introduced in the 8.1.0 line; no public exploit identified at time of analysis. Impact is limited to availability (process crash via memory exhaustion) with no confidentiality or integrity consequence per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector.

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or compromised WebSocket server to crash Node.js client processes by streaming an unbounded number of small or empty continuation frames. Because undici only caps cumulative payload bytes via maxPayloadSize and does not limit fragment count, attackers can drive unbounded memory growth without ever exceeding the configured size threshold. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.

Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending a malformed permessage-deflate compression parameter that bypasses validation and triggers an uncaught exception. The vulnerability exists because the client fails to properly validate the server_max_window_bits parameter before passing it to zlib, enabling any WebSocket server to terminate connected clients. No patch is currently available.

Undici's WebSocket frame parser fails to properly validate 64-bit length fields, causing integer overflow in internal calculations that leaves the parser in an invalid state and crashes the process with a fatal TypeError. An unauthenticated remote attacker can exploit this to achieve denial of service by sending a specially crafted WebSocket frame. Versions 7.24.0, 6.24.0, and later contain fixes for this vulnerability.

Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allows remote attackers to crash or hang affected processes through unbounded memory consumption. An attacker controlling a malicious WebSocket server can send specially crafted compressed frames that expand to extremely large sizes in memory without triggering any decompression limits. No patch is currently available for this vulnerability.

Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9).

Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Undici is an HTTP/1.1 client written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Undici is an HTTP/1.1 client for Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.