p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de undici

Vulnerabilidades publicadas para undici en los últimos 30 días: 3. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 49

  1. CVE-2026-109841

    Media · CVSS 5.9EPSS 0,25%Corrección disponible

    undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only t

    undici undiciNode.js
    • Actualiza a 7.30.1
    • Actualiza a 8.12.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-109924

    Media · CVSS 5.9EPSS 0,32%Corrección disponible

    undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

    undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand in

    undici undici undiciNode.js
    • Actualiza a 6.29.1
    • Actualiza a 7.30.1
    • Actualiza a 8.12.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-109869

    Alta · CVSS 7.5EPSS 0,34%Corrección disponible

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and termina

    undici undici undiciNode.js
    • Actualiza a 6.29.1
    • Actualiza a 7.30.1
    • Actualiza a 8.12.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-18149

    Media · CVSS 5.9EPSS 0,36%Corrección disponible

    undici vulnerable to Denial of Service via orphaned RetryHandler response body

    undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rath

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-18540

    Baja · CVSS 3.7EPSS 0,24%Corrección disponible

    undici vulnerable to downstream response splitting via retry interceptor

    undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a res

    undici undici undiciNode.js
    • Actualiza a 6.28.1
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-19534

    Alta · CVSS 7.5EPSS 0,39%Corrección disponible

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. A

    undici undici undiciNode.js
    • Actualiza a 6.28.1
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-84890

    Media · CVSS 5.9EPSS 0,41%Corrección disponible

    undici vulnerable to Denial of Service via unbounded decompression of compressed responses

    undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-84933

    Media · CVSS 6.5EPSS 0,3%Corrección disponible

    undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

    undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. Th

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-84947

    Baja · CVSS 3.7EPSS 0,2%Corrección disponible

    undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

    undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2026-84961

    Alta · CVSS 7.4EPSS 0,15%Corrección disponible

    undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

    undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affecte

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2026-85008

    Baja · CVSS 3.7EPSS 0,12%Corrección disponible

    undici vulnerable to caching and replay of unsafe HTTP method responses

    undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-85152

    Alta · CVSS 7.4EPSS 0,16%Corrección disponible

    undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

    undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issue

    undiciNode.js
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-85014

    Media · CVSS 5.9EPSS 0,37%Corrección disponible

    undici vulnerable to Denial of Service via WebSocketStream unclean close

    undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a cl

    undici undiciNode.js
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-85024

    Media · CVSS 5.9EPSS 0,41%Corrección disponible

    undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

    undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the li

    undici undici undiciNode.js
    • Actualiza a 6.28.1
    • Actualiza a 7.29.1
    • Actualiza a 8.10.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-15157

    Media · CVSS 4.2EPSS 0,19%Corrección disponible

    undici vulnerable to CRLF Injection via blob-like body 'type' property

    undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validat

    undici undici undiciNode.js
    • Actualiza a 6.28.0
    • Actualiza a 7.29.0
    • Actualiza a 8.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-14643

    Media · CVSS 5.9EPSS 0,4%Corrección disponible

    undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

    undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the

    undici undiciNode.js
    • Actualiza a 7.29.0
    • Actualiza a 8.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-16728

    Media · CVSS 4.8EPSS 0,18%Corrección disponible

    undici vulnerable to downstream response desynchronization via retry interceptor

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emi

    undici undici undiciNode.js
    • Actualiza a 6.28.0
    • Actualiza a 7.29.0
    • Actualiza a 8.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-16729

    Media · CVSS 4.8EPSS 0,19%Corrección disponible

    undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookie

    undici undici undiciNode.js
    • Actualiza a 6.28.0
    • Actualiza a 7.29.0
    • Actualiza a 8.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-13697

    Alta · CVSS 7.4EPSS 0,57%Corrección disponible

    undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

    undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's erro

    undici undiciNode.js
    • Actualiza a 7.29.0
    • Actualiza a 8.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-11525

    Baja · CVSS 3.7EPSS 0,24%Corrección disponible

    undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

    Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or

    undici undici undiciNode.js
    • Actualiza a 6.27.0
    • Actualiza a 7.28.0
    • Actualiza a 8.5.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →