{"schema_version":1,"title":"OpenJS Foundation Undici vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in OpenJS Foundation Undici: 4 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120474, was published on 6 November 2026. 12 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/openjs-foundation-undici","json_url":"https://junglewise.ai/threats/technologies/openjs-foundation-undici.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/openjs-foundation-undici","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":5,"all_time":12,"critical":0,"exploited":0,"last_7_days":4,"last_30_days":12,"last_90_days":12,"last_365_days":12},"latest":[{"cve":"CVE-2026-120474","cvss":6.5,"slug":"cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7","title":"undici cross-user cache disclosure via same-origin redirect","severity":"medium","exploited":false,"published_at":"2026-11-06T10:16:36.913+00:00","url":"https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7"},{"cve":"CVE-2026-120423","cvss":5.9,"slug":"cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through","title":"undici Subresource Integrity bypass via whitespace in integrity metadata","severity":"medium","exploited":false,"published_at":"2026-11-06T10:16:36.78+00:00","url":"https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through"},{"cve":"CVE-2026-120222","cvss":5.9,"slug":"cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7","title":"undici denial of service via unhandled exception in cache-interceptor","severity":"medium","exploited":false,"published_at":"2026-11-06T10:16:36.497+00:00","url":"https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7"},{"cve":"CVE-2026-116592","cvss":7.4,"slug":"cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12","title":"undici cache poisoning and cross-user disclosure via intermediate redirect","severity":"high","exploited":false,"published_at":"2026-11-06T10:16:36.313+00:00","url":"https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12"},{"cve":"CVE-2026-87029","cvss":5.9,"epss":0.0026,"slug":"cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0","title":"undici HTTP client denial of service in decompress interceptor","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:47.05+00:00","url":"https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0"},{"cve":"CVE-2026-87018","cvss":7.5,"epss":0.0019,"slug":"cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1","title":"undici denial of service via TLS 1.2 certificate renegotiation","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:46.6+00:00","url":"https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1"},{"cve":"CVE-2026-109932","cvss":5.9,"epss":0.0032,"slug":"cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0","title":"undici WebSocket client denial of service via unbounded PONG buffering","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:22.3+00:00","url":"https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0"},{"cve":"CVE-2026-109924","cvss":5.9,"epss":0.0032,"slug":"cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0","title":"undici EventSource memory exhaustion denial of service","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:22.18+00:00","url":"https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0"},{"cve":"CVE-2026-109869","cvss":7.5,"epss":0.0034,"slug":"cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0","title":"undici HTTP client denial of service via excessive content-encodings","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:21.77+00:00","url":"https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0"},{"cve":"CVE-2026-109841","cvss":5.9,"epss":0.0025,"slug":"cve-2026-109841-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0","title":"undici Subresource Integrity bypass via non-lowercase algorithm tokens","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:21.64+00:00","url":"https://junglewise.ai/threats/cve-2026-109841-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0"},{"cve":"CVE-2026-109829","cvss":7.4,"epss":0.0015,"slug":"cve-2026-109829-undici-is-an-http-client-library-for-node-js-in-versions-7-0-0","title":"undici cache poisoning and cross-user disclosure via cross-origin redirects","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:21.513+00:00","url":"https://junglewise.ai/threats/cve-2026-109829-undici-is-an-http-client-library-for-node-js-in-versions-7-0-0"},{"cve":"CVE-2026-109383","cvss":7.4,"epss":0.0018,"slug":"cve-2026-109383-undici-is-an-http-client-library-for-node-js-in-versions-4-0-0","title":"undici HTTP client TLS certificate validation bypass in Agent","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:20.853+00:00","url":"https://junglewise.ai/threats/cve-2026-109383-undici-is-an-http-client-library-for-node-js-in-versions-4-0-0"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"OpenJS Foundation Node.js","slug":"openjs-foundation-node-js","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/openjs-foundation-node-js"},{"name":"OpenJS Foundation Multer","slug":"multer","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/multer"},{"name":"OpenJS Foundation Electron","slug":"openjs-foundation-electron","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/openjs-foundation-electron"},{"name":"OpenJS Foundation Morgan","slug":"morgan","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/morgan"},{"name":"OpenJS Foundation Body-Parser","slug":"body-parser","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/body-parser"}],"technology":{"hub":true,"name":"OpenJS Foundation Undici","slug":"openjs-foundation-undici","vendor":{"hub":true,"name":"OpenJS Foundation","slug":"openjs-foundation","url":"https://junglewise.ai/threats/vendors/openjs-foundation"},"aliases":[],"category":"library","url":"https://junglewise.ai/threats/technologies/openjs-foundation-undici"},"most_severe":[{"cve":"CVE-2026-109869","cvss":7.5,"epss":0.0034,"slug":"cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0","title":"undici HTTP client denial of service via excessive content-encodings","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:21.77+00:00","url":"https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0"},{"cve":"CVE-2026-87018","cvss":7.5,"epss":0.0019,"slug":"cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1","title":"undici denial of service via TLS 1.2 certificate renegotiation","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:46.6+00:00","url":"https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1"},{"cve":"CVE-2026-109383","cvss":7.4,"epss":0.0018,"slug":"cve-2026-109383-undici-is-an-http-client-library-for-node-js-in-versions-4-0-0","title":"undici HTTP client TLS certificate validation bypass in Agent","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:20.853+00:00","url":"https://junglewise.ai/threats/cve-2026-109383-undici-is-an-http-client-library-for-node-js-in-versions-4-0-0"},{"cve":"CVE-2026-109829","cvss":7.4,"epss":0.0015,"slug":"cve-2026-109829-undici-is-an-http-client-library-for-node-js-in-versions-7-0-0","title":"undici cache poisoning and cross-user disclosure via cross-origin redirects","severity":"high","exploited":false,"published_at":"2026-10-15T19:17:21.513+00:00","url":"https://junglewise.ai/threats/cve-2026-109829-undici-is-an-http-client-library-for-node-js-in-versions-7-0-0"},{"cve":"CVE-2026-116592","cvss":7.4,"slug":"cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12","title":"undici cache poisoning and cross-user disclosure via intermediate redirect","severity":"high","exploited":false,"published_at":"2026-11-06T10:16:36.313+00:00","url":"https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12"},{"cve":"CVE-2026-120474","cvss":6.5,"slug":"cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7","title":"undici cross-user cache disclosure via same-origin redirect","severity":"medium","exploited":false,"published_at":"2026-11-06T10:16:36.913+00:00","url":"https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7"},{"cve":"CVE-2026-109932","cvss":5.9,"epss":0.0032,"slug":"cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0","title":"undici WebSocket client denial of service via unbounded PONG buffering","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:22.3+00:00","url":"https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0"},{"cve":"CVE-2026-109924","cvss":5.9,"epss":0.0032,"slug":"cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0","title":"undici EventSource memory exhaustion denial of service","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:22.18+00:00","url":"https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0"},{"cve":"CVE-2026-87029","cvss":5.9,"epss":0.0026,"slug":"cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0","title":"undici HTTP client denial of service in decompress interceptor","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:47.05+00:00","url":"https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0"},{"cve":"CVE-2026-109841","cvss":5.9,"epss":0.0025,"slug":"cve-2026-109841-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0","title":"undici Subresource Integrity bypass via non-lowercase algorithm tokens","severity":"medium","exploited":false,"published_at":"2026-10-15T19:17:21.64+00:00","url":"https://junglewise.ai/threats/cve-2026-109841-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}