CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

undici — security advisories

4 advisorieslatest 2026-08-06⚡ RSS feed

Tracked undici products:

WebSocket client undici

⚡ Watch undici

Get an email when a new undici advisory drops — max one per day, one-click unsubscribe.

CVE-2026-15157: undici vulnerable to CRLF Injection via blob-like body 'type' property

mediumCVSS 4.2CVE-2026-15157msrc2026-08-06

CVE-2026-9675: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

highCVSS 7.5CVE-2026-9675msrc2026-06-09

CVE-2026-9697: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

highCVSS 7.4CVE-2026-9697msrc2026-06-09

CVE-2026-11525: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

lowCVSS 3.7CVE-2026-11525msrc2026-06-09