Undici
Monthly
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. Affected are undici 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2; fixes are available in 7.29.1 and 8.10.2, exploitation is not confirmed in CISA KEV, EPSS probability is low (0.25%), and no public exploit code has been identified.
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - including custom `checkServerIdentity` callbacks and custom `connector` functions - during JSON-based deep-cloning of the constructor options object. Affected versions span 7.24.1 through 7.29.0 and 8.0.0 through 8.10.1. An attacker performing a network man-in-the-middle attack can present a TLS certificate that passes Node.js's built-in hostname and chain checks but would have been rejected by the application's custom validation logic, allowing an unauthorized TLS session to be silently established. No public exploit code has been identified at time of analysis, but the CVSS I:H and C:H signals confirm the potential for both data interception and traffic tampering.
Cross-origin cache key confusion in undici 8.10.0 and 8.10.1 allows unauthenticated network attackers to receive responses intended for a different upstream origin and to persistently poison the cache with attacker-controlled content. When the cache or request-deduplication interceptor is composed directly onto a Client or Pool instance, the origin is silently dropped from the key and falls back to an empty string, meaning any two origins sharing the same HTTP method, path, and relevant headers share a single cache slot. The OpenJS Foundation reporter demonstrated full authentication bypass in which a JWT signed with an attacker-controlled key was accepted in place of a trusted issuer's token because the trusted origin was never contacted; no public exploit code has been released at time of analysis.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from a shared cache to subsequent callers, including unauthenticated ones, when the upstream origin sends qualified `no-cache` or `private` Cache-Control directives with optional whitespace (OWS) around the `=` delimiter. Affected deployments are those explicitly running undici 7.0.0-7.28.x or 8.0.0-8.8.x with `interceptors.cache()` in shared mode while forwarding `Authorization` headers upstream. This is a bypass of the earlier CVE-2026-9678 fix; a public proof-of-concept exists and vendor-released patches are available in undici 7.29.0 and 8.9.0.
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions 7.0.0-7.28.x and 8.0.0-8.8.x when the interceptor runs in shared mode (the default). A response bearing a degenerate qualified private directive (e.g. private="") slips past the shared-cache guard and is later served to a different caller sharing the same cache key, leaking private bodies and headers including Set-Cookie; separately, mixing an unqualified and a qualified private directive throws an uncaught TypeError that can crash the process. No public exploit identified at time of analysis, and EPSS is low (0.27%), but the fix is confirmed in undici 7.29.0 and 8.9.0.
TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0) causes the library to reuse a single SOCKS5 connection pool bound to the first-seen origin for every subsequent origin, so credentials and request bodies destined for origin B are silently sent to and trusted from origin A, and HTTPS targets may be downgraded to HTTP. Any Node.js application using Socks5ProxyAgent (directly or via setGlobalDispatcher) that contacts more than one origin is exposed. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and EPSS is very low (0.15%, 4th percentile), but the GHSA advisory ships a regression test demonstrating the misrouting.
Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior to 8.5.0 allows a malicious or compromised WebSocket server to exhaust client memory by streaming many small fragmented frames that individually pass the per-frame maxPayloadSize check but cumulatively bypass any size limit. The flaw is a regression introduced in the 8.1.0 line; no public exploit identified at time of analysis. Impact is limited to availability (process crash via memory exhaustion) with no confidentiality or integrity consequence per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector.
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or compromised WebSocket server to crash Node.js client processes by streaming an unbounded number of small or empty continuation frames. Because undici only caps cumulative payload bytes via maxPayloadSize and does not limit fragment count, attackers can drive unbounded memory growth without ever exceeding the configured size threshold. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending a malformed permessage-deflate compression parameter that bypasses validation and triggers an uncaught exception. The vulnerability exists because the client fails to properly validate the server_max_window_bits parameter before passing it to zlib, enabling any WebSocket server to terminate connected clients. No patch is currently available.
Undici's WebSocket frame parser fails to properly validate 64-bit length fields, causing integer overflow in internal calculations that leaves the parser in an invalid state and crashes the process with a fatal TypeError. An unauthenticated remote attacker can exploit this to achieve denial of service by sending a specially crafted WebSocket frame. Versions 7.24.0, 6.24.0, and later contain fixes for this vulnerability.
Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allows remote attackers to crash or hang affected processes through unbounded memory consumption. An attacker controlling a malicious WebSocket server can send specially crafted compressed frames that expand to extremely large sizes in memory without triggering any decompression limits. No patch is currently available for this vulnerability.
Resource exhaustion in undici's retry handler (versions 7.11.0-<7.29.1 and 8.0.0-<8.10.2) allows an attacker-controlled HTTP server to permanently orphan response body streams, accumulating unreleased promises and memory until application concurrency or heap is exhausted. The flaw arises when a server sends a truncated response body (with Content-Length declared), triggering a retry that returns a non-retryable status code - causing the original body stream to be abandoned without being ended or destroyed, and bypassing the body timeout because the timer is coupled to the connection parser rather than the orphaned stream. No public exploit has been identified at time of analysis, but the attack requires only two crafted HTTP responses and no persistent connection, making automated triggering straightforward against applications that use undici with retry logic enabled.
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
Memory exhaustion via compression bomb in undici's decompress interceptor (versions 7.15.0-<7.29.1 and 8.0.0-<8.10.2) allows a malicious or compromised upstream HTTP server to crash a Node.js process by returning a small compressed payload that expands to hundreds of megabytes in client heap memory. The interceptor respects the untrusted Content-Encoding header and enforces no ceiling on total decompressed output size, making the attack purely asymmetric - a kilobyte-scale upstream payload can trigger unbounded client-side allocation. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog; fixed versions 7.29.1 and 8.10.2 are available.
Chunked-body handling in undici's dump interceptor triggers a double-completion assertion that tears down the underlying TCP connection while returning a misleading success status to the application. Affected are undici versions 7.1.0 through 7.29.0 and 8.0.0 through 8.10.1; fixed releases 7.29.1 and 8.10.2 are available. No public exploit or active exploitation has been identified; the CVSS 3.7 score reflects the high attack complexity and limited real-world impact relative to the narrow exploitation path.
undici's cache interceptor incorrectly permits responses to unsafe HTTP methods - POST, PUT, DELETE, and PATCH - to be stored and later replayed, because the skip-list that gates caching is built by subtracting configured methods from the safe-method set rather than by positively excluding all non-safe methods, leaving unsafe methods unguarded. A remote origin that returns a heuristically cacheable status code or an explicit Cache-Control directive in response to a state-changing request causes undici to store that response; all subsequent client requests to the same path using the same method are then served from the stale cache entry without ever reaching the origin. Affected versions span undici 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1; no public exploit has been identified at time of analysis.
Process-crashing denial of service in undici's WebSocket permessage-deflate implementation allows a remote unauthenticated attacker to terminate any Node.js process hosting the affected client by sending a crafted compressed WebSocket frame. The size-limit enforcement routine strips all event listeners - including the error handler - from the zlib inflate stream while the stream is still active; a subsequent malformed DEFLATE byte then emits an uncaught error that Node.js treats as a fatal unhandled exception, killing the process. Versions 6.25.0-6.28.0, 7.28.0-7.29.0, and 8.1.0-8.10.1 are confirmed affected; fixed releases are available per OpenJS advisory GHSA-3wwx-pv8p-q78v, and no public exploit has been identified at time of analysis.
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. An attacker who controls the type value can append arbitrary HTTP headers to the outgoing request, potentially smuggling a second request past an upstream proxy or server. No public exploit identified at time of analysis and KEV status is not confirmed in the provided data.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.
SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.
Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream server to inject unsolicited HTTP responses onto idle keep-alive sockets, causing subsequent outbound requests to receive falsified responses. All Undici versions across the v6, v7, and v8 branches prior to the patched releases are affected when keep-alive connection reuse is active (the default). While the CVSS score is low (3.7) and no public exploit or KEV listing exists, the integrity impact can carry significant business logic consequences in applications that proxy requests through third-party or partially trusted upstream servers.
Cache information disclosure in Undici's shared-mode cache interceptor allows a prior authenticated user's HTTP response to be served to a subsequent, potentially unauthenticated, caller. Applications using Undici's explicit `interceptors.cache()` in shared mode that forward Authorization headers to an upstream which returns Cache-Control headers with whitespace-padded qualified directives (e.g., `private=" authorization"`) are affected across all v7 versions prior to 7.28.0 and all v8 versions prior to 8.5.0. No public exploit has been identified at time of analysis; exploitation is bounded by high attack complexity (CVSS AC:H, score 5.9), but when conditions align, the confidentiality impact is complete.
HTTP response header injection in undici's cookie parser exposes proxy, middleware, and SSR framework applications to session fixation, open redirect, and cache poisoning. The `parseSetCookie`, `parseCookie`, and `getSetCookies` functions incorrectly percent-decode cookie values using `qsUnescape`, converting encoded sequences such as `%0D%0A` into literal CRLF bytes in violation of RFC 6265 §5.4, which prescribes no such decoding. Any application that fetches from an attacker-controlled upstream and forwards the parsed cookie value into a downstream response header is exploitable; no public exploit has been identified at time of analysis, and patched releases v6.26.0, v7.28.0, and v8.5.0 are available.
Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.
CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers and perform request smuggling attacks against backend services like Redis and Elasticsearch when user input is passed unsanitized to the upgrade option. The vulnerability stems from insufficient validation of the upgrade parameter before writing to the socket, enabling attackers to terminate HTTP requests prematurely and route malicious data to non-HTTP protocols. This requires prior authentication and user interaction, with no patch currently available.
Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9).
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Undici is an HTTP/1.1 client written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Undici is an HTTP/1.1 client for Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. Affected are undici 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2; fixes are available in 7.29.1 and 8.10.2, exploitation is not confirmed in CISA KEV, EPSS probability is low (0.25%), and no public exploit code has been identified.
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - including custom `checkServerIdentity` callbacks and custom `connector` functions - during JSON-based deep-cloning of the constructor options object. Affected versions span 7.24.1 through 7.29.0 and 8.0.0 through 8.10.1. An attacker performing a network man-in-the-middle attack can present a TLS certificate that passes Node.js's built-in hostname and chain checks but would have been rejected by the application's custom validation logic, allowing an unauthorized TLS session to be silently established. No public exploit code has been identified at time of analysis, but the CVSS I:H and C:H signals confirm the potential for both data interception and traffic tampering.
Cross-origin cache key confusion in undici 8.10.0 and 8.10.1 allows unauthenticated network attackers to receive responses intended for a different upstream origin and to persistently poison the cache with attacker-controlled content. When the cache or request-deduplication interceptor is composed directly onto a Client or Pool instance, the origin is silently dropped from the key and falls back to an empty string, meaning any two origins sharing the same HTTP method, path, and relevant headers share a single cache slot. The OpenJS Foundation reporter demonstrated full authentication bypass in which a JWT signed with an attacker-controlled key was accepted in place of a trusted issuer's token because the trusted origin was never contacted; no public exploit code has been released at time of analysis.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from a shared cache to subsequent callers, including unauthenticated ones, when the upstream origin sends qualified `no-cache` or `private` Cache-Control directives with optional whitespace (OWS) around the `=` delimiter. Affected deployments are those explicitly running undici 7.0.0-7.28.x or 8.0.0-8.8.x with `interceptors.cache()` in shared mode while forwarding `Authorization` headers upstream. This is a bypass of the earlier CVE-2026-9678 fix; a public proof-of-concept exists and vendor-released patches are available in undici 7.29.0 and 8.9.0.
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions 7.0.0-7.28.x and 8.0.0-8.8.x when the interceptor runs in shared mode (the default). A response bearing a degenerate qualified private directive (e.g. private="") slips past the shared-cache guard and is later served to a different caller sharing the same cache key, leaking private bodies and headers including Set-Cookie; separately, mixing an unqualified and a qualified private directive throws an uncaught TypeError that can crash the process. No public exploit identified at time of analysis, and EPSS is low (0.27%), but the fix is confirmed in undici 7.29.0 and 8.9.0.
TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0) causes the library to reuse a single SOCKS5 connection pool bound to the first-seen origin for every subsequent origin, so credentials and request bodies destined for origin B are silently sent to and trusted from origin A, and HTTPS targets may be downgraded to HTTP. Any Node.js application using Socks5ProxyAgent (directly or via setGlobalDispatcher) that contacts more than one origin is exposed. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and EPSS is very low (0.15%, 4th percentile), but the GHSA advisory ships a regression test demonstrating the misrouting.
Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior to 8.5.0 allows a malicious or compromised WebSocket server to exhaust client memory by streaming many small fragmented frames that individually pass the per-frame maxPayloadSize check but cumulatively bypass any size limit. The flaw is a regression introduced in the 8.1.0 line; no public exploit identified at time of analysis. Impact is limited to availability (process crash via memory exhaustion) with no confidentiality or integrity consequence per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector.
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or compromised WebSocket server to crash Node.js client processes by streaming an unbounded number of small or empty continuation frames. Because undici only caps cumulative payload bytes via maxPayloadSize and does not limit fragment count, attackers can drive unbounded memory growth without ever exceeding the configured size threshold. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending a malformed permessage-deflate compression parameter that bypasses validation and triggers an uncaught exception. The vulnerability exists because the client fails to properly validate the server_max_window_bits parameter before passing it to zlib, enabling any WebSocket server to terminate connected clients. No patch is currently available.
Undici's WebSocket frame parser fails to properly validate 64-bit length fields, causing integer overflow in internal calculations that leaves the parser in an invalid state and crashes the process with a fatal TypeError. An unauthenticated remote attacker can exploit this to achieve denial of service by sending a specially crafted WebSocket frame. Versions 7.24.0, 6.24.0, and later contain fixes for this vulnerability.
Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allows remote attackers to crash or hang affected processes through unbounded memory consumption. An attacker controlling a malicious WebSocket server can send specially crafted compressed frames that expand to extremely large sizes in memory without triggering any decompression limits. No patch is currently available for this vulnerability.
Resource exhaustion in undici's retry handler (versions 7.11.0-<7.29.1 and 8.0.0-<8.10.2) allows an attacker-controlled HTTP server to permanently orphan response body streams, accumulating unreleased promises and memory until application concurrency or heap is exhausted. The flaw arises when a server sends a truncated response body (with Content-Length declared), triggering a retry that returns a non-retryable status code - causing the original body stream to be abandoned without being ended or destroyed, and bypassing the body timeout because the timer is coupled to the connection parser rather than the orphaned stream. No public exploit has been identified at time of analysis, but the attack requires only two crafted HTTP responses and no persistent connection, making automated triggering straightforward against applications that use undici with retry logic enabled.
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
Memory exhaustion via compression bomb in undici's decompress interceptor (versions 7.15.0-<7.29.1 and 8.0.0-<8.10.2) allows a malicious or compromised upstream HTTP server to crash a Node.js process by returning a small compressed payload that expands to hundreds of megabytes in client heap memory. The interceptor respects the untrusted Content-Encoding header and enforces no ceiling on total decompressed output size, making the attack purely asymmetric - a kilobyte-scale upstream payload can trigger unbounded client-side allocation. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog; fixed versions 7.29.1 and 8.10.2 are available.
Chunked-body handling in undici's dump interceptor triggers a double-completion assertion that tears down the underlying TCP connection while returning a misleading success status to the application. Affected are undici versions 7.1.0 through 7.29.0 and 8.0.0 through 8.10.1; fixed releases 7.29.1 and 8.10.2 are available. No public exploit or active exploitation has been identified; the CVSS 3.7 score reflects the high attack complexity and limited real-world impact relative to the narrow exploitation path.
undici's cache interceptor incorrectly permits responses to unsafe HTTP methods - POST, PUT, DELETE, and PATCH - to be stored and later replayed, because the skip-list that gates caching is built by subtracting configured methods from the safe-method set rather than by positively excluding all non-safe methods, leaving unsafe methods unguarded. A remote origin that returns a heuristically cacheable status code or an explicit Cache-Control directive in response to a state-changing request causes undici to store that response; all subsequent client requests to the same path using the same method are then served from the stale cache entry without ever reaching the origin. Affected versions span undici 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1; no public exploit has been identified at time of analysis.
Process-crashing denial of service in undici's WebSocket permessage-deflate implementation allows a remote unauthenticated attacker to terminate any Node.js process hosting the affected client by sending a crafted compressed WebSocket frame. The size-limit enforcement routine strips all event listeners - including the error handler - from the zlib inflate stream while the stream is still active; a subsequent malformed DEFLATE byte then emits an uncaught error that Node.js treats as a fatal unhandled exception, killing the process. Versions 6.25.0-6.28.0, 7.28.0-7.29.0, and 8.1.0-8.10.1 are confirmed affected; fixed releases are available per OpenJS advisory GHSA-3wwx-pv8p-q78v, and no public exploit has been identified at time of analysis.
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. An attacker who controls the type value can append arbitrary HTTP headers to the outgoing request, potentially smuggling a second request past an upstream proxy or server. No public exploit identified at time of analysis and KEV status is not confirmed in the provided data.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.
SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.
Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream server to inject unsolicited HTTP responses onto idle keep-alive sockets, causing subsequent outbound requests to receive falsified responses. All Undici versions across the v6, v7, and v8 branches prior to the patched releases are affected when keep-alive connection reuse is active (the default). While the CVSS score is low (3.7) and no public exploit or KEV listing exists, the integrity impact can carry significant business logic consequences in applications that proxy requests through third-party or partially trusted upstream servers.
Cache information disclosure in Undici's shared-mode cache interceptor allows a prior authenticated user's HTTP response to be served to a subsequent, potentially unauthenticated, caller. Applications using Undici's explicit `interceptors.cache()` in shared mode that forward Authorization headers to an upstream which returns Cache-Control headers with whitespace-padded qualified directives (e.g., `private=" authorization"`) are affected across all v7 versions prior to 7.28.0 and all v8 versions prior to 8.5.0. No public exploit has been identified at time of analysis; exploitation is bounded by high attack complexity (CVSS AC:H, score 5.9), but when conditions align, the confidentiality impact is complete.
HTTP response header injection in undici's cookie parser exposes proxy, middleware, and SSR framework applications to session fixation, open redirect, and cache poisoning. The `parseSetCookie`, `parseCookie`, and `getSetCookies` functions incorrectly percent-decode cookie values using `qsUnescape`, converting encoded sequences such as `%0D%0A` into literal CRLF bytes in violation of RFC 6265 §5.4, which prescribes no such decoding. Any application that fetches from an attacker-controlled upstream and forwards the parsed cookie value into a downstream response header is exploitable; no public exploit has been identified at time of analysis, and patched releases v6.26.0, v7.28.0, and v8.5.0 are available.
Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.
CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers and perform request smuggling attacks against backend services like Redis and Elasticsearch when user input is passed unsanitized to the upgrade option. The vulnerability stems from insufficient validation of the upgrade parameter before writing to the socket, enabling attackers to terminate HTTP requests prematurely and route malicious data to non-HTTP protocols. This requires prior authentication and user interaction, with no patch currently available.
Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9).
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Undici is an HTTP/1.1 client written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Undici is an HTTP/1.1 client for Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.