Vulnerability history

NPM: undici vulnerable to Denial of Service via orphaned RetryHandler response body

NPM: undici vulnerable to downstream response splitting via retry interceptor

NPM: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

NPM: undici vulnerable to Denial of Service via unbounded decompression of compressed responses

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

NPM: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

NPM: undici vulnerable to caching and replay of unsafe HTTP method responses

NPM: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

NPM: undici vulnerable to Denial of Service via WebSocketStream unclean close

NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

NPM: undici vulnerable to CRLF Injection via blob-like body 'type' property

NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

NPM: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

NPM: undici vulnerable to downstream response desynchronization via retry interceptor

NPM: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

NPM: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

NPM: undici WebSocket client vulnerable to denial of service via fragment count bypass

NPM: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

NPM: undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

NPM: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

NPM: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

NPM: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

NPM: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

NPM: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

NPM: Undici has CRLF Injection in undici via `upgrade` option

NPM: Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

NPM: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

NPM: Undici has an HTTP Request/Response Smuggling issue

NPM: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

NPM: undici Denial of Service attack via bad certificate data

NPM: Use of Insufficiently Random Values in undici

NPM: Undici vulnerable to data leak when using response.arrayBuffer()

NPM: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

NPM: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

NPM: Undici proxy-authorization header not cleared on cross-origin redirect in fetch

NPM: fetch(url) leads to a memory leak in undici

NPM: Undici's cookie header not cleared on cross-origin redirect in fetch

NPM: CRLF Injection in Nodejs ‘undici’ via host

NPM: Regular Expression Denial of Service in Headers

NPM: Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

NPM: `undici.request` vulnerable to SSRF using absolute URL on `pathname`

NPM: undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

NPM: undici before v5.8.0 vulnerable to CRLF injection in request headers

NPM: ProxyAgent vulnerable to MITM