U
Vendor security profile
undici
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs32
Critical2
CISA KEV0
Public exploit2
Patch rate%56
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
3
0
0
4
5
0
11
9
CVE KEV
CVE severity distribution
32toplam CVE
Critical2 (6%)
High16 (50%)
Medium12 (38%)
Low2 (6%)
Patch and exploitation view
%56
Verified patch
%0
CISA KEV
%6
Public exploit
18Patch available
0Partial
0Workaround
0Vendor: no patch
14Unknown
Latest vulnerabilities
5.9
CVE-2026-87029
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
U
Patch status unknown
5.9
CVE-2026-109932
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
U
Patch status unknown
7.5
CVE-2026-87018
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
U
Patch status unknown
7.4
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
U
Patch status unknown
7.4
CVE-2026-109829
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
U
Patch status unknown
5.9
CVE-2026-109841
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
U
Patch status unknown
5.9
CVE-2026-109924
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
U
Patch status unknown
7.5
CVE-2026-109869
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
U
Patch status unknown
7.5
CVE-2026-109855
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
U
Patch status unknownEPSS %0
7.4
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
U
Patch verifiedEPSS %1