These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-9697 is a high-severity vulnerability (CVSS score of 7.4) affecting undici's ProxyAgent when used with SOCKS5 proxy URIs. The issue causes the requestTls option to be silently dropped, leading to a fallback to Node's default trust store. This can result in unintended trust anchor changes, allowing for potential MITM attacks. The vulnerability was introduced in undici version 7.23.0 and can be mit [truncated]
The CVE record describes a vulnerability in undici's cookie parser. The parser percent-decodes cookie values via qsUnescape, which can lead to HTTP response header injection. This vulnerability was introduced in undici 7.0.0 and can be exploited by an attacker-controlled upstream. Affected applications are those that use undici's cookie parsing and forward the parsed cookie value into a response header. T [truncated]
CVE-2026-9678 is a vulnerability in Undici's cache interceptor. The cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names. This allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both request [truncated]
CVE-2026-6734 is a high-severity vulnerability affecting the undici module in Node.js. The vulnerability arises from the improper reuse of a single connection pool across different origins when using Socks5ProxyAgent. This can lead to cross-origin request routing, where credentials and request data intended for one origin are sent to another. The impact is significant, with a CVSS score of 7.5 and a HIGH [truncated]
CVE-2026-6733 is a vulnerability in Undici's HTTP/1.1 client that allows response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivere [truncated]
CVE-2026-11525 is a vulnerability in undici, a Node.js HTTP/1.1 client. When undici parses a Set-Cookie header, it accepts any SameSite attribute value containing 'Strict', 'Lax', or 'None' as a substring, rather than matching exactly as per RFC 6265. This allows malicious servers to coerce consumers into adopting weaker SameSite cookie policies, potentially leading to security downgrades. The issue was i [truncated]
CVE-2026-12151 is a high-severity vulnerability in the undici WebSocket client. A malicious WebSocket server can exploit this vulnerability by streaming many small or empty continuation frames, causing unbounded memory growth in the client process, leading to memory exhaustion and a denial of service. This vulnerability affects applications using the undici WebSocket client or the WebSocketStream API that [truncated]