Is undici 8.4 vulnerable?
npm · 2 releases from 8.4.0 to 8.4.1 · latest undici is 8.12.3 · checked 2 Nov 2026
Yes: 30 known advisories
Yes. undici 8.4.1, the last 8.4 release, is affected by 30 known security advisories (10 high, 15 medium, 5 low), including CVE-2026-109829, CVE-2026-109383, CVE-2026-87018. Upgrade to 8.12.2 or later to fix all of them.
npm install undici@8.12.2Advisories affecting undici 8.4.1
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
- Affected
- >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- Affected
- >=4.0.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- Affected
- >=4.2.1 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- Affected
- >=5.15.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- Affected
- >=6.23.0 <6.29.1 · >=7.18.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- Affected
- >=6.5.0 <6.29.1 · >=7.0.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 6.29.1, 7.30.1, 8.12.2
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- Affected
- >=7.15.0 <7.30.1 · >=8.0.0 <8.12.2
- Fixed in
- 7.30.1, 8.12.2
undici vulnerable to Denial of Service via orphaned RetryHandler response body
- Affected
- >=7.11.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to downstream response splitting via retry interceptor
- Affected
- <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- Affected
- >=6.7.0 <6.28.1 · >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
- Affected
- >=7.15.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
- Affected
- >=7.1.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
- Affected
- >=7.24.1 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to caching and replay of unsafe HTTP method responses
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to Denial of Service via WebSocketStream unclean close
- Affected
- >=7.0.0 <7.29.1 · >=8.0.0 <8.10.2
- Fixed in
- 7.29.1, 8.10.2
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
- Affected
- >=6.25.0 <6.28.1 · >=7.28.0 <7.29.1 · >=8.1.0 <8.10.2
- Fixed in
- 6.28.1, 7.29.1, 8.10.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
- Affected
- >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 7.29.0, 8.9.0
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to downstream response desynchronization via retry interceptor
- Affected
- <6.28.0 · >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 6.28.0, 7.29.0, 8.9.0
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- Affected
- >=7.0.0 <7.29.0 · >=8.0.0 <8.9.0
- Fixed in
- 7.29.0, 8.9.0
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via fragment count bypass
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
- Affected
- <6.27.0 · >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 6.27.0, 7.28.0, 8.5.0
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
- Affected
- >=7.23.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 7.28.0, 8.5.0
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
- Affected
- >=7.0.0 <7.28.0 · >=8.0.0 <8.5.0
- Fixed in
- 7.28.0, 8.5.0
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
- Affected
- >=8.0.0 <8.5.0
- Fixed in
- 8.5.0
Which of your client projects are still on undici 8.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact undici version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other undici versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.