chore(deps): update dependency undici@>=7.0.0 <7.29.0 to ^7.29.1 [security] - autoclosed - #1246

Details

Impact

undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (POST, PUT, PATCH, DELETE) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (canCacheResponse) having no method check, a heuristically-cacheable response (for example a 404) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (methods: ['GET']), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.

Patches

Upgrade to 7.29.1 or 8.10.2. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.

Workarounds

None.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv
• https://nvd.nist.gov/vuln/detail/CVE-2026-85008
• https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3
• https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-8436-99hf-9mmv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

undici's BalancedPool passes its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-upstream Pool. JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPool. Client, Pool, Agent, and RoundRobinPool destructure connect/tls before the clone and are not affected. Only applications that use BalancedPool with a function-valued connect/tls option (such as a custom checkServerIdentity or connector) are affected.

Patches

Upgrade to 7.29.1 or 8.10.2. BalancedPool now preserves the connect and tls options outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.

Workarounds

Use Client, Pool, or Agent instead of BalancedPool for connections that rely on a custom checkServerIdentity or connector, until upgraded.

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3
• https://nvd.nist.gov/vuln/detail/CVE-2026-84961
• https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390
• https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-w293-vg96-wgc3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked (no Content-Length) and its body exceeds maxSize, it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.

Patches

Upgrade to 7.29.1 or 8.10.2. The dump interceptor now enforces maxSize on both the declared and the received body size, aborting the request with a RequestAbortedError instead of returning a truncated response.

Workarounds

None. Avoid using interceptors.dump() with untrusted upstreams until upgraded.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968
• https://nvd.nist.gov/vuln/detail/CVE-2026-84947
• https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae
• https://github.com/nodejs/undici/commit/6d583124e7cf60b640097d64144ed633cc450584
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-2gqq-gqf2-x968

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for example Cache-Control: public, max-age=...) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (type: 'private') are not affected.

Patches

Upgrade to 7.29.1 or 8.10.2. In shared-cache mode, undici no longer stores or re-serves responses containing Set-Cookie, including previously cached entries and revalidation paths.

Workarounds

Use a private cache (type: 'private') for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip Set-Cookie from responses before caching.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
• https://nvd.nist.gov/vuln/detail/CVE-2026-84933
• https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988
• https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-2jfj-6hjv-fm6j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).

For example, a 404 Not Found with Content-Length: 2 that sends one byte then closes can be resumed with an open-ended Range request, and the resumed 206 Partial Content bytes are appended, so the application receives more than two body bytes while still seeing Content-Length: 2. The bug requires interceptors.retry() enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate Content-Length.

Patches

Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.

Workarounds

• Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0.
• Remove or recalculate Content-Length before forwarding a response body assembled by Undici.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r
• https://nvd.nist.gov/vuln/detail/CVE-2026-18540
• https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329
• https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95
• https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548
• https://hackerone.com/reports/3900104
• https://hackerone.com/reports/3900615
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v6.28.1
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-r53p-7pc4-xj5r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.

Patches

Patched in undici v7.29.1 and v8.10.2.

Workarounds

Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x
• https://nvd.nist.gov/vuln/detail/CVE-2026-18149
• https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74
• https://github.com/nodejs/undici/commit/e905b5b87e6953bcc542af90557b2fee5b7b5974
• https://hackerone.com/reports/3892751
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-pmjh-fq2x-6v4x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v7.29.1

Compare Source

⚠️ Security fixes

High severity

• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

• [v7.x] drop: remove Node.js 26 from shared-builtin CI build by @​mcollina in #​5592
• fix(h2): honour headersTimeout by @​mcollina in #​5604
• fix(h2): keep the connection ref'd while requests are outstanding by @​mcollina in #​5605
• ci: increase Windows workflow timeout on v7.x by @​mcollina in #​5621
• fix(h2): retire the request that completed, not the head of the queue by @​mcollina in #​5618
• fix(h2): settle a request whose stream is cancelled by @​mcollina in #​5607
• perf: reduce EventSourceStream parser allocations (#​5032) by @​mcollina in #​5646
• fix(h2): handle GOAWAY for CONNECT streams by @​mcollina in #​5640
• [v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#​5707) by @​mcollina in #​5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1