Is undici 6.25 vulnerable?
npm · 1 release from 6.25.0 to 6.25.0 · latest undici is 8.12.3 · checked 2 Nov 2026
Yes: 15 known advisories
Yes. undici 6.25.0, the last 6.25 release, is affected by 15 known security advisories (5 high, 7 medium, 3 low), including CVE-2026-109383, CVE-2026-87018, CVE-2026-109869. Upgrade to 6.29.1 or later to fix all of them.
npm install undici@6.29.1Advisories affecting undici 6.25.0
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- Affected
- >=4.0.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- Affected
- >=4.2.1 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Affected
- >=5.15.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- Affected
- >=6.23.0 <6.29.1 · >=7.18.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- Affected
- >=6.5.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to downstream response splitting via retry interceptor
- Affected
- <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- Affected
- >=6.7.0 <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
- Affected
- >=6.25.0 <6.28.1 · >=7.28.0 <7.29.1 · >=8.1.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to downstream response desynchronization via retry interceptor
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via fragment count bypass
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
Which of your client projects are still on undici 6.25?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact undici version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other undici versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.