undici NPM Package
Vulnerability Check

Undici has an HTTP Request/Response Smuggling issue

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

undici before v5.8.0 vulnerable to CRLF injection in request headers

Undici vulnerable to data leak when using response.arrayBuffer()

Undici has CRLF Injection in undici via `upgrade` option

CRLF Injection in Nodejs ‘undici’ via host

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

fetch(url) leads to a memory leak in undici

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Use of Insufficiently Random Values in undici

undici Denial of Service attack via bad certificate data

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

ProxyAgent vulnerable to MITM

Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

Regular Expression Denial of Service in Headers

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

undici WebSocket client vulnerable to denial of service via fragment count bypass

Undici's cookie header not cleared on cross-origin redirect in fetch