nodejs Undici
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in nodejs Undici.
By the Year
In 2026 there have been 1 vulnerability in nodejs Undici with an average score of 5.9 out of ten. Last year, in 2025 Undici had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Undici in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 2.80.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 5.90 |
| 2025 | 1 | 3.10 |
| 2024 | 4 | 4.38 |
| 2023 | 3 | 5.47 |
| 2022 | 5 | 6.92 |
It may take a day or so for new Undici vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent nodejs Undici Security Vulnerabilities
Undici Node.js HTTP Client <7.18.0/6.23.0: Unbounded Decompression Chain
CVE-2026-22036
5.9 - Medium
- January 14, 2026
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
Allocation of Resources Without Limits or Throttling
Undici Mem Leak via Repeated Webhook Calls <5.29.0/6.21.2/7.5.0
CVE-2025-47279
3.1 - Low
- May 15, 2025
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
Memory Leak
Undici Auth Header Leak via request() before 5.28.4/6.11.1
CVE-2024-30260
3.9 - Low
- April 04, 2024
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
AuthZ
Undici HTTP Client Integrity Bypass via fetch() - Fixed v5.28.4/6.11.1
CVE-2024-30261
2.6 - Low
- April 04, 2024
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Authorization
Undici ProxyAuth Header Leak on Redirect before 5.28.3/6.6.1
CVE-2024-24758
4.5 - Medium
- February 16, 2024
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Information Disclosure
Undici memory leak via fetch (6.6.0) consume body to mitigate
CVE-2024-24750
6.5 - Medium
- February 16, 2024
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Memory Leak
Undici HTTP Client Cookie Header Leak via Redirect (pre-5.26.2)
CVE-2023-45143
3.5 - Low
- October 12, 2023
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
Information Disclosure
Undici <5.19.1 ReDoS in Headers.set/append (HTTP client)
CVE-2023-24807
7.5 - High
- February 16, 2023
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
ReDoS
Undici v2.0.0-5.19.0: CRLF Host Header Injection Vulnerability
CVE-2023-23936
5.4 - Medium
- February 16, 2023
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
Injection
CRLF Injection on Content-Type Header in Undici v5.8.0
CVE-2022-35948
5.3 - Medium
- August 15, 2022
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
Injection
undici SSRF via path option pre-5.8.1
CVE-2022-35949
9.8 - Critical
- August 12, 2022
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.
SSRF
Authorization headers are cleared on cross-origin redirect
CVE-2022-31151
6.5 - Medium
- July 21, 2022
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).
Open Redirect
undici is an HTTP/1.1 client, written from scratch for Node.js
CVE-2022-31150
6.5 - Medium
- July 19, 2022
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
CRLF Injection
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy
CVE-2022-32210
6.5 - Medium
- July 14, 2022
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Improper Certificate Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for nodejs Undici or by nodejs? Click the Watch button to subscribe.
