• Project uses undici 6.x before 6.29.1, 7.x before 7.30.1, or 8.x before 8.12.2.
• Application calls undici's fetch() against servers that may be attacker-controlled or malicious.
• The server responds with more than five content codings and closes the connection before sending the body.

Affected

undici >=6.23.0 <6.29.1 · undici >=7.18.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-xjj6-f33q-929c

• Project uses undici's EventSource client.
• undici version is below 6.29.1, 7.30.1, or 8.12.2 in the respective major line.
• The application maintains an EventSource connection to an untrusted or potentially compromised Server-Sent Events peer that controls the response.

Affected

undici >=6.5.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-4qv8-2p9j-2685

• Project uses undici at version 7.15.0 or later, below the patched releases 7.30.1 / 8.12.2.
• Application calls undici's fetch() with Subresource Integrity (integrity) metadata.
• The integrity metadata uses an uppercase or mixed-case algorithm token (e.g. SHA256- or Sha256-).
• An attacker can control the response body returned by the server.

Affected

undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-f72v-6w45-q472

• undici version is 7.x before 7.30.1 or 8.x before 8.12.2.
• An originless Agent dispatcher is used (not an origin-bound Client or Pool).
• Interceptors are composed as compose(redirect(), cache()) (not compose(cache(), redirect())).
• The cache interceptor uses a shared cache (type: 'shared') backed by a MemoryCacheStore or SqliteCacheStore.
• Requests can follow redirects whose targets can be attacker-controlled or user-specific (e.g. cross-origin or private/no-store redirects).

Affected

undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-4w7w-5xrc-9h26

• Project uses undici at a version before 6.29.1, 7.30.1, or 8.12.2.
• Requests are made through undici's Agent (including as default dispatcher for request, fetch, setGlobalDispatcher) or EnvHttpProxyAgent on direct/NO_PROXY routes.
• The Agent is constructed with a function-valued tls option, such as a custom checkServerIdentity callback for certificate or public-key pinning.
• The TLS options are passed via the tls option rather than via connect.

Affected

undici >=4.0.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-2m5v-pch6-74hx

• Project uses undici (directly or via Node.js global fetch()) at a version before 6.29.1, 7.30.1, or 8.12.2.
• The client makes HTTPS requests to an endpoint that is malicious or compromised.
• The connection to that endpoint negotiates TLS 1.2 (not restricted to TLS 1.3).
• The server initiates renegotiation after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host.

Affected

undici >=4.2.1 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-qrxm-fqhp-jwvm

• Project uses undici's WebSocket client (directly or via Node.js's bundled globalThis.WebSocket).
• Installed undici version is 5.15.0 or later in the 5.x line, or a 6.x, 7.x, or 8.x release earlier than 6.29.1, 7.30.1, or 8.12.2 respectively.
• The client connects to a WebSocket server that is malicious or compromised and can stream PING frames without reading PONG responses.

Affected

undici >=5.15.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-9fm3-97px-rjf6

• Project uses undici at a version before 7.30.1 (7.x) or before 8.12.2 (8.x).
• The client composes undici's decompress interceptor with a downstream response handler that throws during response processing (e.g. the dump interceptor with maxSize).
• The client makes requests to an HTTP server that may be malicious or compromised and can return a compressed body that decompresses beyond the configured limit.

Affected

undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-55wc-3pg8-jfw6

Source summary

Impact undici's experimental WebSocket client (enabled by default via allowH2: true ) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny s

Affected

undici >=8.11.0 <8.11.2

Fixed in

8.11.2

ID

GHSA-qq8j-7v2v-3rwp

Source summary

Impact undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service. Patches Patched in undici v7.29.1 and v8.10.2. Workarounds Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Affected

undici >=7.11.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-pmjh-fq2x-6v4x

Source summary

Impact Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length , the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length , and the excess bytes can be read as the start of a subsequent

Affected

undici <6.28.1 · undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-r53p-7pc4-xj5r

Source summary

Impact The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try / catch , so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext ws:// connection subject to a machine-in-the-middle. It affects the default ne

Affected

undici >=6.7.0 <6.28.1 · undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-rfgv-xxqx-mfg5

Source summary

Impact The interceptors.decompress() interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty upstream can return a small compressed payload (a compression bomb) that expands to hundreds of megabytes or gigabytes in client memory, exhausting memory and causing the Node.js process to crash or become unresponsive. Any application using the decompress interceptor to read responses from untrusted

Affected

undici >=7.15.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-3xpg-4rpp-hhhm

Source summary

Impact undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode ( type: 'shared' , the default), a cacheable response (for example Cache-Control: public, max-age=... ) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interc

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-2jfj-6hjv-fm6j

Source summary

Impact undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize . When a response declares a Content-Length that exceeds maxSize , the request is aborted cleanly. When a response is sent chunked (no Content-Length ) and its body exceeds maxSize , it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize , and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated bo

Affected

undici >=7.1.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-2gqq-gqf2-x968

Source summary

Impact undici's BalancedPool passes its constructor options through a JSON-based deep clone ( JSON.parse(JSON.stringify(...)) ) before forwarding them to each per-upstream Pool . JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPo

Affected

undici >=7.24.1 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-w293-vg96-wgc3

Source summary

Impact undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method ( POST , PUT , PATCH , DELETE ) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate ( canCacheResponse ) having no method check, a heuristically-cacheable response (for example a 404 ) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changin

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-8436-99hf-9mmv

Source summary

Impact When interceptors.cache() or interceptors.deduplicate() is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin , undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together. An attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers

Affected

undici >=8.10.0 <8.10.2

Fixed in

8.10.2

ID

GHSA-vp8m-p9jh-q5pm

Source summary

Impact undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort() on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a TypeError , and the handler discards that promise. The unobserved rejection surfaces as an unhandledRejection and, under Node.js's default behavior, terminates the process. A malicious or compromised WebSocket server can crash

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-rx4f-c7p8-82vq

Source summary

Impact undici's WebSocket client (including Node.js's bundled globalThis.WebSocket ) crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In lib/web/websocket/permessage-deflate.js , the size-limit cleanup calls removeAllListeners() on the internal zlib InflateRaw , removing its error listener, but leaves the stream running. The inflater then emits a Z DATA ERROR with no listener attached, which Node.js treats as a fatal unhandled error event an

Affected

undici >=6.25.0 <6.28.1 · undici >=7.28.0 <7.29.1 · undici >=8.1.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-3wwx-pv8p-q78v