Is undici 8.11 vulnerable?
npm · 3 releases from 8.11.0 to 8.11.2 · latest undici is 8.12.3 · checked 2 Nov 2026
Yes: 8 known advisories
Yes. undici 8.11.2, the last 8.11 release, is affected by 8 known security advisories (4 high, 4 medium), including CVE-2026-109829, CVE-2026-109383, CVE-2026-87018. 1 more affects earlier 8.11.x releases. Upgrade to 8.12.2 or later to fix all of them.
npm install undici@8.12.2Advisories affecting undici 8.11.2
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
- Affected
- >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- Affected
- >=4.0.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- Affected
- >=4.2.1 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Affected
- >=5.15.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- Affected
- >=6.23.0 <6.29.1 · >=7.18.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- Affected
- >=6.5.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
Fixed within 8.11.x, affecting earlier releases
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
- Affected
- >=8.11.0 <8.11.2
- Fixed in
- 8.11.2
Which of your client projects are still on undici 8.11?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact undici version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other undici versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.