Skip to content
Threat Feed
Subscribe

Product

Undici (>= 8.0.0, < 8.12.2)

2 briefs RSS
high advisory

undici: TLS certificate validation bypass in Agent (CVE-2026-109383)

The undici library fails to enforce custom TLS certificate validation callbacks in Agent constructor options due to a JSON-based cloning mechanism, potentially allowing invalid TLS connections.

undici +2
1c
high advisory

undici: Cache poisoning and cross-user data disclosure via cross-origin redirects (CVE-2026-109829)

The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.

undici +1
1t 1c