# undici (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/undici Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/undici.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 53 vulnerabilities in undici (npm): 0 in the last 7 days and 20 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-87029, was published on 15 October 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 20 - All time: 53 (0 critical, 0 exploited in the wild) ## About undici (npm) Undici is an HTTP/1.1 client for Node.js written entirely in JavaScript. ## Latest undici (npm) vulnerabilities - [CVE-2026-87029: undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0) (medium, CVSS 5.9, published 15 Oct 2026) - [CVE-2026-87018: undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-109932: undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0) (medium, CVSS 5.9, published 15 Oct 2026) - [CVE-2026-109924: undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0) (medium, CVSS 5.9, published 15 Oct 2026) - [CVE-2026-109869: undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-109841: undici Subresource Integrity bypass via non-lowercase algorithm tokens](https://junglewise.ai/threats/cve-2026-109841-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0) (medium, CVSS 5.9, published 15 Oct 2026) - [CVE-2026-109829: undici cache poisoning and cross-user disclosure via cross-origin redirects](https://junglewise.ai/threats/cve-2026-109829-undici-is-an-http-client-library-for-node-js-in-versions-7-0-0) (high, CVSS 7.4, published 15 Oct 2026) - [CVE-2026-109383: undici HTTP client TLS certificate validation bypass in Agent](https://junglewise.ai/threats/cve-2026-109383-undici-is-an-http-client-library-for-node-js-in-versions-4-0-0) (high, CVSS 7.4, published 15 Oct 2026) - [CVE-2026-109855: undici WebSocket client denial of service via failed HTTP/2 handshake](https://junglewise.ai/threats/cve-2026-109855-undici-is-an-http-client-library-for-node-js-in-versions-8-11-0) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-84890: undici decompress interceptor unbounded decompression DoS](https://junglewise.ai/threats/cve-2026-84890-undici-decompress-interceptor-unbounded-decompression-dos) (medium, CVSS 5.9, published 4 Sep 2026) - [CVE-2026-19534: undici WebSocket client denial of service via unrequested subprotocol](https://junglewise.ai/threats/cve-2026-19534-undici-websocket-client-denial-of-service-via-unrequested) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-18540: Node.js undici downstream response splitting via retry interceptor](https://junglewise.ai/threats/cve-2026-18540-node-js-undici-downstream-response-splitting-via-retry) (low, CVSS 3.7, published 4 Sep 2026) - [CVE-2026-18149: undici retry handler response body leak](https://junglewise.ai/threats/cve-2026-18149-undici-retry-handler-response-body-leak) (medium, CVSS 5.9, published 4 Sep 2026) - [CVE-2026-85152: undici cross-origin cache poisoning via missing origin isolation](https://junglewise.ai/threats/cve-2026-85152-undici-cross-origin-cache-poisoning-via-missing-origin-isolation) (high, CVSS 7.4, published 4 Sep 2026) - [CVE-2026-85024: undici WebSocket permessage-deflate denial of service](https://junglewise.ai/threats/cve-2026-85024-undici-websocket-permessage-deflate-denial-of-service) (medium, CVSS 5.9, published 4 Sep 2026) - [CVE-2026-85014: undici WebSocketStream denial of service via unclean close](https://junglewise.ai/threats/cve-2026-85014-undici-websocketstream-denial-of-service-via-unclean-close) (medium, CVSS 5.9, published 4 Sep 2026) - [CVE-2026-85008: undici cache interceptor unsafe HTTP method caching](https://junglewise.ai/threats/cve-2026-85008-undici-cache-interceptor-unsafe-http-method-caching) (low, CVSS 3.7, published 4 Sep 2026) - [CVE-2026-84961: undici BalancedPool TLS certificate validation bypass via dropped connect options](https://junglewise.ai/threats/cve-2026-84961-undici-balancedpool-tls-certificate-validation-bypass-via-dropped) (high, CVSS 7.4, published 4 Sep 2026) - [CVE-2026-84947: undici response truncation via oversized chunked responses in dump interceptor](https://junglewise.ai/threats/cve-2026-84947-undici-response-truncation-via-oversized-chunked-responses-in) (low, CVSS 3.7, published 4 Sep 2026) - [CVE-2026-84933: undici cache interceptor Set-Cookie disclosure in shared caches](https://junglewise.ai/threats/cve-2026-84933-undici-cache-interceptor-set-cookie-disclosure-in-shared-caches) (medium, CVSS 6.5, published 4 Sep 2026) - [CVE-2026-15157: undici CRLF injection in blob-like request body type property](https://junglewise.ai/threats/cve-2026-15157-undici-crlf-injection-in-blob-like-request-body-type-property) (medium, CVSS 4.2, published 29 Jul 2026) - [CVE-2026-14643: Node.js undici information disclosure via Cache-Control whitespace bypass](https://junglewise.ai/threats/cve-2026-14643-node-js-undici-information-disclosure-via-cache-control) (medium, CVSS 5.9, published 29 Jul 2026) - [CVE-2026-16728: Node.js undici response desynchronization in retry interceptor](https://junglewise.ai/threats/cve-2026-16728-node-js-undici-response-desynchronization-in-retry-interceptor) (medium, CVSS 4.8, published 29 Jul 2026) - [CVE-2026-16729: Node.js undici cookie attribute injection in setCookie](https://junglewise.ai/threats/cve-2026-16729-node-js-undici-cookie-attribute-injection-in-setcookie) (medium, CVSS 4.8, published 29 Jul 2026) - [CVE-2026-13697: undici information disclosure and crash in cache interceptor](https://junglewise.ai/threats/cve-2026-13697-undici-information-disclosure-and-crash-in-cache-interceptor) (high, CVSS 7.4, published 29 Jul 2026) ## Most severe undici (npm) vulnerabilities - [CVE-2026-1526: Node.js undici DoS via unbounded WebSocket decompression memory consumption](https://junglewise.ai/threats/cve-2026-1526-node-js-undici-dos-via-unbounded-websocket-decompression-memory) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2026-2229: Node.js undici denial of service via invalid WebSocket compression parameters](https://junglewise.ai/threats/cve-2026-2229-node-js-undici-denial-of-service-via-invalid-websocket-compression) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2026-12151: Node.js undici denial of service in WebSocket fragment handling](https://junglewise.ai/threats/cve-2026-12151-node-js-undici-denial-of-service-in-websocket-fragment-handling) (high, CVSS 7.5, published 17 Jun 2026) - [CVE-2026-9675: Node.js undici denial of service via cumulative WebSocket fragment bypass](https://junglewise.ai/threats/cve-2026-9675-node-js-undici-denial-of-service-via-cumulative-websocket-fragment) (high, CVSS 7.5, published 17 Jun 2026) - [CVE-2026-1528: Node.js undici denial of service via WebSocket length overflow](https://junglewise.ai/threats/cve-2026-1528-node-js-undici-denial-of-service-via-websocket-length-overflow) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2026-19534: undici WebSocket client denial of service via unrequested subprotocol](https://junglewise.ai/threats/cve-2026-19534-undici-websocket-client-denial-of-service-via-unrequested) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-6734: Node.js undici cross-origin request routing in SOCKS5 ProxyAgent](https://junglewise.ai/threats/cve-2026-6734-node-js-undici-cross-origin-request-routing-in-socks5-proxyagent) (high, CVSS 7.5, published 17 Jun 2026) - [CVE-2026-109869: undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-109855: undici WebSocket client denial of service via failed HTTP/2 handshake](https://junglewise.ai/threats/cve-2026-109855-undici-is-an-http-client-library-for-node-js-in-versions-8-11-0) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-87018: undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1) (high, CVSS 7.5, published 15 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 11 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 9 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities - [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe): 36 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "undici (npm) vulnerabilities", https://junglewise.ai/threats/technologies/undici, 13 November 2026.