Is undici 8.12 vulnerable?
npm · 4 releases from 8.12.0 to 8.12.3 · latest undici is 8.12.3 · checked 1 Nov 2026
No known advisories in the last release
undici 8.12.3, the last 8.12 release, has no known advisories. 8 advisories affect earlier 8.12.x releases, so update to 8.12.3.
npm install undici@8.12.3Fixed within 8.12.x, affecting earlier releases
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
- Affected
- >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- Affected
- >=4.0.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- Affected
- >=4.2.1 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Affected
- >=5.15.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- Affected
- >=6.23.0 <6.29.1 · >=7.18.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- Affected
- >=6.5.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
Which of your client projects are still on undici 8.12?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact undici version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other undici versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.