# Nodejs Undici


- [CVE-2026-109855](https://insights.sbomify.com/CVE-2026-109855/): undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake (high 7.5)
- [CVE-2026-109869](https://insights.sbomify.com/CVE-2026-109869/): undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (high 7.5)
- [CVE-2026-87018](https://insights.sbomify.com/CVE-2026-87018/): undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation (high 7.5)
- [CVE-2026-19534](https://insights.sbomify.com/CVE-2026-19534/): undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (high 7.5)
- [CVE-2026-12151](https://insights.sbomify.com/CVE-2026-12151/): undici WebSocket client vulnerable to denial of service via fragment count bypass (high 7.5)
- [CVE-2026-6734](https://insights.sbomify.com/CVE-2026-6734/): undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse (high 7.5)
- [CVE-2026-9675](https://insights.sbomify.com/CVE-2026-9675/): undici WebSocket client vulnerable to denial of service via cumulative fragment bypass (high 7.5)
- [CVE-2026-1526](https://insights.sbomify.com/CVE-2026-1526/): undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression (high 7.5)
- [CVE-2026-1528](https://insights.sbomify.com/CVE-2026-1528/): undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client (high 7.5)
- [CVE-2026-2229](https://insights.sbomify.com/CVE-2026-2229/): undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation (high 7.5)
- [CVE-2023-24807](https://insights.sbomify.com/CVE-2023-24807/): Undici vulnerable to Regular Expression Denial of Service in Headers (high 7.5)
- [CVE-2026-109383](https://insights.sbomify.com/CVE-2026-109383/): undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/products/nodejs/undici/