Vulnerabilities

TI-2026-74894 CVE-2026-109932 · GHSA-9fm3-97px-rjf6

Undici WebSocket client exhausts memory via unbounded PONG buffering

LOW 33

undici is an HTTP client library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00321 Published 2026-10-15 Partial fix · 6.29.1, 7.30.1 +1 CWE-400

TI-2026-74992 CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

LOW 38

undici is an HTTP client library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00187 Published 2026-10-15 Partial fix · 6.29.1, 7.30.1 +1 CWE-248

TI-2026-74886 CVE-2026-109383 · GHSA-2m5v-pch6-74hx

MEDIUM 40

undici is an HTTP client library for Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00184 Published 2026-10-15 Partial fix · 6.29.1, 7.30.1 +1 CWE-295

TI-2026-74893 CVE-2026-109924 · GHSA-4qv8-2p9j-2685

LOW 33

undici is an HTTP client library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00321 Published 2026-10-15 Partial fix · 6.29.1, 7.30.1 +1 CWE-770

TI-2026-74890 CVE-2026-109869 · GHSA-xjj6-f33q-929c

LOW 39

undici is an HTTP client library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00344 Published 2026-10-15 Partial fix · 6.29.1, 7.30.1 +1 CWE-248