Vulnerabilidades em undici
45 resultadosAnálise Vexday
O undici registra 14 vulnerabilidades na base Vexday, com 8 divulgações nos últimos 90 dias indicando atividade recente de descobertas; nenhuma está sob exploração ativa (KEV) e não há críticas CVSS, reduzindo a urgência operacional imediata. A fraqueza dominante é CWE-770 (alocação de recursos sem limite apropriado), um padrão típico de negação de serviço que requer monitoramento em ambientes de alto volume.
CVE-2026-1527MEDIUMundici is vulnerable to CRLF Injection via upgrade optionEPSS 0.3%CVE-2026-18540LOWundici vulnerable to downstream response splitting via retry interceptorEPSS 0.3%CVE-2026-120222MEDIUMundici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replayEPSS 0.3%CVE-2026-84933MEDIUMundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesEPSS 0.3%CVE-2026-120415MEDIUMundici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect strippingEPSS 0.3%CVE-2026-16728MEDIUMundici vulnerable to downstream response desynchronization via retry interceptorEPSS 0.3%CVE-2026-120474MEDIUMundici vulnerable to cross-user cache disclosure via same-origin redirectEPSS 0.3%CVE-2026-109855HIGHundici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeEPSS 0.3%CVE-2026-16729MEDIUMundici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsEPSS 0.3%CVE-2026-15157MEDIUMundici vulnerable to CRLF Injection via blob-like body 'type' propertyEPSS 0.3%CVE-2026-87029MEDIUMundici vulnerable to Denial of Service via unhandled exception in the decompress interceptorEPSS 0.3%CVE-2026-9679MEDIUMundici vulnerable to HTTP header injection via Set-Cookie percent-decodingEPSS 0.3%CVE-2026-109841MEDIUMundici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensEPSS 0.3%CVE-2026-11525LOWundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingEPSS 0.2%CVE-2026-6733LOWundici vulnerable to HTTP response queue poisoning via keep-alive socket reuseEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2026-87018HIGHundici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationEPSS 0.2%CVE-2026-109383HIGHundici vulnerable to TLS certificate validation bypass via dropped tls options in AgentEPSS 0.2%CVE-2026-84961HIGHundici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolEPSS 0.2%CVE-2026-85152HIGHundici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsEPSS 0.2%