Is undici 6.4 vulnerable?
npm · 1 release from 6.4.0 to 6.4.0 · latest undici is 8.12.3 · checked 2 Nov 2026
Yes: 23 known advisories
Yes. undici 6.4.0, the last 6.4 release, is affected by 23 known security advisories (6 high, 10 medium, 7 low), including CVE-2026-109383, CVE-2026-87018, CVE-2026-12151. Upgrade to 6.29.1 or later to fix all of them.
npm install undici@6.29.1Advisories affecting undici 6.4.0
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- Affected
- >=4.0.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- Affected
- >=4.2.1 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Affected
- >=5.15.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to downstream response splitting via retry interceptor
- Affected
- <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to downstream response desynchronization via retry interceptor
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via fragment count bypass
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has CRLF Injection in undici via `upgrade` option
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
- Affected
- >=6.0.0 <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has an HTTP Request/Response Smuggling issue
- Affected
- <6.24.0 · >=7.0.0 <7.24.0
- Fixed in
- 6.24.0, 7.24.0
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
- Affected
- >=7.0.0 <7.18.2 · <6.23.0
- Fixed in
- 6.23.0, 7.18.2
undici Denial of Service attack via bad certificate data
- Affected
- <5.29.0 · >=6.0.0 <6.21.2 · >=7.0.0 <7.5.0
- Fixed in
- 5.29.0, 6.21.2, 7.5.0
Use of Insufficiently Random Values in undici
- Affected
- >=4.5.0 <5.28.5 · >=6.0.0 <6.21.1 · >=7.0.0 <7.2.3
- Fixed in
- 5.28.5, 6.21.1, 7.2.3
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
- Affected
- <5.28.4 · >=6.0.0 <6.11.1
- Fixed in
- 5.28.4, 6.11.1
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
- Affected
- <5.28.4 · >=6.0.0 <6.11.1
- Fixed in
- 5.28.4, 6.11.1
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
- Affected
- <5.28.3 · >=6.0.0 <6.6.1
- Fixed in
- 5.28.3, 6.6.1
fetch(url) leads to a memory leak in undici
- Affected
- >=6.0.0 <6.6.1
- Fixed in
- 6.6.1
Which of your client projects are still on undici 6.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact undici version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other undici versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.