npm

undici

55 Total advisories

55 Vulnerabilities

0 Malware

Dependency scanning

Check whether undici is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

undici

Vulnerabilities

undici WebSocket client vulnerable to denial of service via fragment count bypass

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici vulnerable to downstream response splitting via retry interceptor

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici vulnerable to caching and replay of unsafe HTTP method responses

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici vulnerable to Denial of Service via WebSocketStream unclean close

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

undici vulnerable to CRLF Injection via blob-like body 'type' property

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici vulnerable to downstream response desynchronization via retry interceptor

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Use of Insufficiently Random Values in undici

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Undici has CRLF Injection in undici via `upgrade` option

Undici has an HTTP Request/Response Smuggling issue

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

undici Denial of Service attack via bad certificate data

Undici vulnerable to data leak when using response.arrayBuffer()

Regular Expression Denial of Service in Headers

fetch(url) leads to a memory leak in undici

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

CRLF Injection in Nodejs ‘undici’ via host

ProxyAgent vulnerable to MITM

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

Undici's cookie header not cleared on cross-origin redirect in fetch

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

undici before v5.8.0 vulnerable to CRLF injection in request headers

Browse more npm advisories

Start Securing