Undici vulnerabilities

3 known vulnerabilities in Undici from Node.js. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  undici: Allocation of Resources Without Limits or Throttling

  CVE-2026-22036Jan 14, 2026Node.js

  Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excess

• 7.5 High severity

  undici: Inefficient Regular Expression Complexity

  CVE-2023-24807Feb 16, 2023Node.jsEPSS 1.31%

  Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the

• 9.8 Critical severity

  undici: Server-Side Request Forgery

  CVE-2022-35949Aug 12, 2022Node.jsEPSS 1.93%

  undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http