Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: undici 6.28.0, 7.29.0, 8.9.0 Clear all filters
TI-2026-12768 CVE-2026-15157 · GHSA-m8rv-5g2x-5cg5

undici vulnerable to CRLF Injection via blob-like body 'type' property

Priority LOW 24

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00261 Published 2026-07-29 Partial fix · 6.28.0, 7.29.0 +1 CWE-93
TI-2026-13930 CVE-2026-16728 · GHSA-8xcm-r25x-g524

undici vulnerable to downstream response desynchronization via retry interceptor

Priority LOW 29

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00288 Published 2026-07-29 Partial fix · 6.28.0, 7.29.0 +1 CWE-444