Browse CVEs

HIGH 7.5 CVE-2026-14643 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. I… Undici 7.29.0 / 8.9.0+ Fix from $1,9502026-07-29 MEDIUM 5.4 CVE-2026-15157 undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatch… Undici 6.28.0 / 7.29.0+ Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-16728 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry… Undici 6.28.0 / 7.29.0+ Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-16729 undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to … Undici 6.28.0 / 7.29.0+ Fix from $1,6002026-07-29 CRITICAL 9.1 CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a… Undici 7.29.0 / 8.9.0+ Fix from $2,3002026-07-29 CRITICAL 9.8 CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolve… Node.js Patch available Fix from $2,3002026-06-26 HIGH 7.5 CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affe… Node.js Patch available Fix from $1,9502026-06-26 HIGH 7.5 CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embe… Node.js Patch available Fix from $1,9502026-06-26 HIGH 7.5 CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the clien… Node.js Patch available Fix from $1,9502026-06-26 MEDIUM 6.5 CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to … Node.js Patch available Fix from $1,6002026-06-26 MEDIUM 5.4 CVE-2026-48928 A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supporte… Node.js Patch available Fix from $1,6002026-06-26 HIGH 7.5 CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supp… Node.js Mitigation only Fix from $1,9502026-06-18 HIGH 7.4 CVE-2026-9697 Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS co… Undici 7.28.0 / 8.5.0+ Fix from $1,9502026-06-17 MEDIUM 5.9 CVE-2026-9678 Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded q… Undici 7.28.0 / 8.5.0+ Fix from $1,6002026-06-17 MEDIUM 5.9 CVE-2026-9679 Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %… Undici 6.27.0 / 7.28.0+ Fix from $1,6002026-06-17 HIGH 8.8 CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches… Undici 7.28.0 / 8.2.0+ Fix from $1,9502026-06-17 HIGH 7.5 CVE-2026-9675 Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A… Undici 8.5.0+ Fix from $1,9502026-06-17 HIGH 7.5 CVE-2026-12151 Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on th… Undici 6.27.0 / 7.28.0+ Fix from $1,9502026-06-17 HIGH 7.5 CVE-2026-1528 ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal ma… Undici 6.24.0 / 7.24.0+ Fix from $1,9502026-03-12 HIGH 7.5 CVE-2026-2229 ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in t… Undici 6.24.0 / 7.24.0+ Fix from $1,9502026-03-12 MEDIUM 5.9 CVE-2026-2581 This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when i… Undici 7.24.0+ Fix from $1,6002026-03-12 HIGH 7.5 CVE-2026-1526 The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. Whe… Undici 6.24.0 / 7.24.0+ Fix from $1,9502026-03-12 CRITICAL 9.8 CVE-2026-1525 Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-leng… Undici 6.24.0 / 7.24.0+ Fix from $2,3002026-03-12 CRITICAL 10.0 CVE-2026-21636 A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even … Node.js 25.3.0+ Fix from $2,3002026-01-20 HIGH 7.5 CVE-2026-21637 A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are i… Node.js 20.20.0 / 22.22.0+ Fix from $1,9502026-01-20 HIGH 7.5 CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECON… Node.js 20.20.0 / 22.22.0+ Fix from $1,9502026-01-20 HIGH 7.5 CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()`… Node.js 20.20.0 / 22.22.0+ Fix from $1,9502026-01-20 CRITICAL 9.1 CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink… Node.js 20.20.0 / 22.22.0+ Fix from $2,3002026-01-20 HIGH 7.5 CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When … Node.js 24.12.0+ Fix from $1,9502026-01-20 MEDIUM 5.3 CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only … Node.js 20.20.0 / 22.22.0+ Fix from $1,6002026-01-20