BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Undici

Undici Security Releases - October 2026

undici-2026-10 Oct 1, 2026 Source: Vendor

Undici security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-109855
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

17 lines
All 17 CVEs 17 Additional recognition 0 Unclaimed only
Showing 1–17 of 17
CVE-2026-109855 BR2026-0000-032389 undici unclaimed
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket han...
Credited as kjsik11
CVE-2026-109869 BR2026-0000-032674 undici unclaimed
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malic...
Credited as hanityx
CVE-2026-109924 BR2026-0000-032677 undici unclaimed
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a m...
Credited as iamibi
CVE-2026-109924 BR2026-0000-032678 undici unclaimed
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a m...
Credited as KhafraDev
CVE-2026-109383 BR2026-0000-032700 undici unclaimed
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-ba...
Credited as euriconicacio
CVE-2026-109383 BR2026-0000-032701 undici unclaimed
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-ba...
Credited as BlueN0r
CVE-2026-109383 BR2026-0000-032702 undici unclaimed
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-ba...
Credited as ksanjeev284
CVE-2026-109829 BR2026-0000-032703 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a s...
Credited as Kushalkhemka
CVE-2026-109829 BR2026-0000-032704 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a s...
Credited as mayank-jangid-moon
CVE-2026-109829 BR2026-0000-032705 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a s...
Credited as bengsky13
CVE-2026-109829 BR2026-0000-032706 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a s...
Credited as skigeek16
CVE-2026-109841 BR2026-0000-032707 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorith...
Credited as Kushalkhemka
CVE-2026-109841 BR2026-0000-032708 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorith...
Credited as mayank-jangid-moon
CVE-2026-109841 BR2026-0000-032709 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorith...
Credited as skigeek16
CVE-2026-87018 BR2026-0000-032712 undici unclaimed
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after t...
Credited as benzdeus
CVE-2026-109932 BR2026-0000-032713 undici unclaimed
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Nod...
Credited as benzdeus
CVE-2026-87029 BR2026-0000-032793 undici unclaimed
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler fr...
Credited as Yanhaoxi