chore(deps): update dependency undici@<6.27.0 to v8 [security] by renovate[bot] · Pull Request #191 · logto-io/auth-wiki

renovate · 2026-08-04T01:32:30Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici@<6.27.0 (source)	`^6.27.0` → `^8.10.2`

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE-2026-13697 / GHSA-4cwx-7wf7-3272

More information

Details

Summary

Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js:

Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.
Parse-time crash: Mixed unqualified-and-qualified private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the cache-control parser, terminating the request.

Impact

Shared-cache disclosure

Applications using interceptors.cache() in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including Set-Cookie.

Required conditions:

the cache interceptor is enabled in shared mode, including the default configuration;
an upstream returns a malformed directive such as Cache-Control: public, max-age=300, private="";
another request later matches the same cache key, without a separating Vary header.

Parse-time crash

Applications using interceptors.cache() against an upstream that returns a Cache-Control header combining unqualified private with qualified private="..." see an uncaught TypeError: output.private.concat is not a function during response handling. The request rejects; depending on the consumer's error handling, the process may exit.

Details

private="" is parsed as { private: [''] }. The shared-cache guard only rejects private === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.

For the crash variant, an unqualified private directive sets output.private = true, then a subsequent qualified private="hdr" directive attempts output.private.concat(['hdr']), which throws because boolean has no concat method.

The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to true and preserves existing true values, closing both vectors.

Patches

Upgrade to undici 7.29.0 or 8.9.0. Both releases fix the qualified private directive handling that caused the shared-cache storage and the parser crash.

Workarounds

Until patched, avoid shared interceptors.cache() for user-specific responses, use type: 'private', or disable caching for affected origins.

Credit

Disclosure variant reported by @h0rk1p via HackerOne report #3817497.

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to downstream response desynchronization via retry interceptor

CVE-2026-16728 / GHSA-8xcm-r25x-g524

More information

Details

Impact

Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.

A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:

Content-Range: bytes 0-99/300
Content-Length: 300

and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.

The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds

Disable interceptors.retry() for untrusted upstreams.
Remove or recalculate Content-Length before forwarding a response body assembled or transformed by Undici.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

CVE-2026-16729 / GHSA-v3r7-h72x-cjcm

More information

Details

Impact

The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.

Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0.

Workarounds

Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
Do not pass user-controlled data to the unparsed field.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

CVE-2026-14643 / GHSA-jr45-8vmc-qm54

More information

Details

Impact

Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.

Patches

Upgrade to undici v7.29.0 or v8.9.0.

Workarounds

If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to CRLF Injection via blob-like body 'type' property

CVE-2026-15157 / GHSA-m8rv-5g2x-5cg5

More information

Details

Impact

When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.

The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through isValidHeaderValue():

} else if (util.isBlobLike(body) && request.contentType == null && body.type) {
  headers.push('content-type', body.type)  // bypasses isValidHeaderValue()
}

The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled .type. Native Blob is safe because its constructor strips CRLF from .type. fetch() is unaffected because it validates via the Headers class. Ecosystem consumers that build duck-typed blob shapes from user input include form-data-encoder, formdata-polyfill, and formdata-node.

Same defect class as CVE-2022-35948 (explicit content-type sink, fixed in undici 5.8.2) and CVE-2026-1527 (upgrade option sink, fixed in 6.24.0 / 7.24.0), both closed by adding isValidHeaderValue() on their respective sinks. This branch was missed.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds

Set an explicit, validated content-type header on the request options (skips the vulnerable branch).
Use a native Blob (or fetch-blob) instead of a hand-rolled duck-typed object.
Reject control characters in the MIME type before assigning it to .type.
Use fetch() instead of the non-fetch APIs.

Severity

CVSS Score: 4.2 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to caching and replay of unsafe HTTP method responses

CVE-2026-85008 / GHSA-8436-99hf-9mmv

More information

Details

Impact

undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (POST, PUT, PATCH, DELETE) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (canCacheResponse) having no method check, a heuristically-cacheable response (for example a 404) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (methods: ['GET']), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.

Patches

Upgrade to 7.29.1 or 8.10.2. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.

Workarounds

None.

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

CVE-2026-84961 / GHSA-w293-vg96-wgc3

More information

Details

Impact

undici's BalancedPool passes its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-upstream Pool. JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPool. Client, Pool, Agent, and RoundRobinPool destructure connect/tls before the clone and are not affected. Only applications that use BalancedPool with a function-valued connect/tls option (such as a custom checkServerIdentity or connector) are affected.

Patches

Upgrade to 7.29.1 or 8.10.2. BalancedPool now preserves the connect and tls options outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.

Workarounds

Use Client, Pool, or Agent instead of BalancedPool for connections that rely on a custom checkServerIdentity or connector, until upgraded.

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

CVE-2026-84933 / GHSA-2jfj-6hjv-fm6j

More information

Details

Impact

undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for example Cache-Control: public, max-age=...) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (type: 'private') are not affected.

Patches

Upgrade to 7.29.1 or 8.10.2. In shared-cache mode, undici no longer stores or re-serves responses containing Set-Cookie, including previously cached entries and revalidation paths.

Workarounds

Use a private cache (type: 'private') for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip Set-Cookie from responses before caching.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to downstream response splitting via retry interceptor

CVE-2026-18540 / GHSA-r53p-7pc4-xj5r

More information

Details

Impact

Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).

For example, a 404 Not Found with Content-Length: 2 that sends one byte then closes can be resumed with an open-ended Range request, and the resumed 206 Partial Content bytes are appended, so the application receives more than two body bytes while still seeing Content-Length: 2. The bug requires interceptors.retry() enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate Content-Length.

Patches

Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.

Workarounds

Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0.
Remove or recalculate Content-Length before forwarding a response body assembled by Undici.

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

CVE-2026-84947 / GHSA-2gqq-gqf2-x968

More information

Details

Impact

undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked (no Content-Length) and its body exceeds maxSize, it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.

Patches

Upgrade to 7.29.1 or 8.10.2. The dump interceptor now enforces maxSize on both the declared and the received body size, aborting the request with a RequestAbortedError instead of returning a truncated response.

Workarounds

None. Avoid using interceptors.dump() with untrusted upstreams until upgraded.

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to Denial of Service via orphaned RetryHandler response body

CVE-2026-18149 / GHSA-pmjh-fq2x-6v4x

More information

Details

Impact

undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.

Patches

Patched in undici v7.29.1 and v8.10.2.

Workarounds

Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici@<6.27.0)

`v8.10.2`

Compare Source

⚠️ Security fixes

High severity

GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #5653
build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @dependabot[bot] in #5750
build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @dependabot[bot] in #5752
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @dependabot[bot] in #5754
test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @zeexzeex in #5725
fix(retry): reject invalid resumed responses by @mcollina in #5724
test: make stale-while-revalidate cache update test deterministic by @mcollina in #5722
fix: avoid unbounded recursion in Set-Cookie attribute parser by @mcollina in #5757
fix: honor SOCKS5 connection timeout by @mcollina in #5733
fix(eventsource): validate Last-Event-ID on reconnect by @mcollina in #5746
fix: avoid duplicate release attempts by @mcollina in #5745
fix(cache): refetch when 304 adds vary fields by @mcollina in #5732
types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @RaphaelFakhri in #5721
ci(codeql): align CodeQL action versions to v4.37.9 by @mcollina in #5759
build(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 by @dependabot[bot] in #5760
fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @mcollina in #5758
docs: name the parameters these two blocks describe by @darkdi in #5735
fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @kjsik11 in #5751
test(node-fetch): re-enable the set-cookie header combining test by @pacocartones in #5730
fix(retry): forward rawHeaders writes through RetryController by @official-burak in #5727
fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @kjsik11 in #5738

New Contributors

@darkdi made their first contribution in #5735
@kjsik11 made their first contribution in #5751
@official-burak made their first contribution in #5727

Full Changelog: nodejs/undici@v8.10.1...v8.10.2

`v8.10.1`

Compare Source

What's Changed

fix(mock): re-invoke reply callback for persistent mocks by @mcollina in #5650
fix: preserve MockAgent interceptors for legacy global fetch by @pacocartones in #5648
ci: align codeql-action autobuild and analyze with init at v4.37.3 by @ostapondo in #5655
ci: test against the current Node.js nightly major by @ostapondo in #5654
ci: only accept a numeric nightly major by @ostapondo in #5657
test: complete the h2 settings round-trip before asserting single-session multiplexing by @ostapondo in #5656
fix: propagate dispatcher origin to composed interceptors by @jibin7jose in #5624
fix: limit EventSource event size by @mcollina in #5552
build(deps-dev): bump ws from 8.21.1 to 8.21.3 by @dependabot[bot] in #5678
fix(retry): honor the retryAfter option in the default retry strategy by @codeAnqiang-ma in #5683
fix(interceptor/dump): reject aborted requests when response is smaller than maxSize by @codeAnqiang-ma in #5685
test: add unexpected disconnect guards to remaining http2 tests by @zeexzeex in #5686
test: harden http2-request-never-settles against late session errors by @pacocartones in #5674
fix(test): skip cache-tests when submodule is missing by @edenbuilds in #5661
fix(retry): honor the abort signal during the retry backoff by @pacocartones in #5675
fix(deduplicate): settle the deduplicated request when it is aborted by @pacocartones in #5673
build(deps-dev): bump esbuild from 0.28.1 to 0.28.2 by @dependabot[bot] in #5698
build(deps-dev): bump @fastify/busboy from 3.2.0 to 3.2.1 by @dependabot[bot] in #5697
fix: accept a negative Set-Cookie Max-Age attribute by @arshsmith1 in #5571
fix(h2): honour maxResponseSize by @ondraulehla in #5676
test: stabilize HTTP/2 timeout tests by @mcollina in #5689
fix: forward onBodySent/onRequestSent through interceptor handlers by @adarshx01 in #5696
perf(h1): drop idle-socket timer floor with a ref'd setImmediate by @anonrig in #5707
perf(fetch): skip empty RequestInit work by @anonrig in #5701
fix: propagate dispatcher options to base class by @mcollina in #5687
fix(env-http-proxy-agent): ignore trailing dots when matching no_proxy by @pacocartones in #5637
build(deps-dev): bump @fastify/busboy from 3.2.1 to 3.2.2 by @dependabot[bot] in #5718
build(deps): bump brace-expansion by @dependabot[bot] in #5719
fix(socks5-proxy-agent): destroy socket when negotiation times out by @abhijeet117 in #5709
fix(cache): evict entries when a key holds a single entry by @mcollina in #5737
test: restore /xhr to the WPT filter by @RaphaelFakhri in #5723
fix(h2): forward 1xx informational responses to onInfo by @pacocartones in #5712
fix(agent): preserve pools with pending GOAWAY replays by @mcollina in #5740
test: skip HTTP/2 churn test on Node.js 26 by @mcollina in #5742

New Contributors

@ostapondo made their first contribution in #5655
@jibin7jose made their first contribution in #5624
@codeAnqiang-ma made their first contribution in #5683
@zeexzeex made their first contribution in #5686
@edenbuilds made their first contribution in #5661
@arshsmith1 made their first contribution in #5571
@ondraulehla made their first contribution in #5676
@adarshx01 made their first contribution in #5696
@abhijeet117 made their first contribution in #5709
@RaphaelFakhri made their first contribution in #5723

Full Changelog: nodejs/undici@v8.10.0...v8.10.1

`v8.10.0`

Compare Source

What's Changed

feat: namespace h2 options by @metcoder95 in #5498
test: update WPT expectations by @mcollina in #5587
test: add cache/dedupe + dns re-dispatch integration tests by @GiHoon1123 in #5535
fix(websocket): support process.unref by @mcollina in #5578
fix(h2): ensure every request settles by @mcollina in #5603
fix(readable): consume a body whose end has already been emitted by @marko1olo in #5617
fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @marko1olo in #5610
fix: revert idle socket validatio

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2026-08-04T01:39:28Z

Deploying auth-wiki with Cloudflare Pages

Latest commit:	`a059ad1`
Status:	✅ Deploy successful!
Preview URL:	https://9d18bc98.auth-wiki.pages.dev
Branch Preview URL:	https://renovate-npm-undici-6-27-0-v.auth-wiki.pages.dev

View logs

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 790d406 to d69406a Compare August 12, 2026 01:33

renovate Bot temporarily deployed to cloudflare-pages August 12, 2026 01:33 Inactive

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from d69406a to 68f18d4 Compare August 12, 2026 09:56

renovate Bot had a problem deploying to cloudflare-pages August 12, 2026 09:56 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 68f18d4 to a059ad1 Compare August 14, 2026 17:38

renovate Bot temporarily deployed to cloudflare-pages August 14, 2026 17:38 Inactive

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from a059ad1 to dbf19ce Compare August 14, 2026 23:52

renovate Bot had a problem deploying to cloudflare-pages August 14, 2026 23:52 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from dbf19ce to f6c7dfd Compare August 21, 2026 15:49

renovate Bot had a problem deploying to cloudflare-pages August 21, 2026 15:49 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from f6c7dfd to 07d40bd Compare August 21, 2026 19:57

renovate Bot had a problem deploying to cloudflare-pages August 21, 2026 19:57 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 07d40bd to 3f723cb Compare August 22, 2026 15:55

renovate Bot had a problem deploying to cloudflare-pages August 22, 2026 15:55 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 3f723cb to 7d2d628 Compare August 22, 2026 18:45

renovate Bot had a problem deploying to cloudflare-pages August 22, 2026 18:45 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 7d2d628 to 9c4524b Compare August 26, 2026 15:42

renovate Bot had a problem deploying to cloudflare-pages August 26, 2026 15:57 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 9c4524b to d1a9505 Compare August 27, 2026 00:03

renovate Bot had a problem deploying to cloudflare-pages August 27, 2026 00:03 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from d1a9505 to 011a7d5 Compare September 2, 2026 21:31

renovate Bot had a problem deploying to cloudflare-pages September 2, 2026 21:31 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 011a7d5 to 5e008d2 Compare September 3, 2026 04:07

renovate Bot had a problem deploying to cloudflare-pages September 3, 2026 04:07 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 5e008d2 to 6d640b6 Compare September 3, 2026 13:28

renovate Bot had a problem deploying to cloudflare-pages September 3, 2026 13:28 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 6d640b6 to 0499bb9 Compare September 4, 2026 02:43

renovate Bot had a problem deploying to cloudflare-pages September 4, 2026 02:43 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 0499bb9 to 9b016b8 Compare September 8, 2026 00:34

renovate Bot had a problem deploying to cloudflare-pages September 15, 2026 11:01 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from fbf5a5d to a4a05c8 Compare September 16, 2026 02:32

renovate Bot had a problem deploying to cloudflare-pages September 16, 2026 02:32 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from a4a05c8 to 9684c9c Compare September 16, 2026 16:03

renovate Bot had a problem deploying to cloudflare-pages September 16, 2026 16:03 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 9684c9c to 85c9b7f Compare September 16, 2026 20:59

renovate Bot had a problem deploying to cloudflare-pages September 16, 2026 20:59 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 85c9b7f to 07f6c14 Compare September 17, 2026 17:29

renovate Bot had a problem deploying to cloudflare-pages September 17, 2026 17:29 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 07f6c14 to f41bb45 Compare September 17, 2026 23:22

renovate Bot had a problem deploying to cloudflare-pages September 17, 2026 23:22 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from f41bb45 to 4e094ed Compare September 18, 2026 20:30

renovate Bot had a problem deploying to cloudflare-pages September 18, 2026 20:30 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 4e094ed to 1448254 Compare September 19, 2026 01:51

renovate Bot had a problem deploying to cloudflare-pages September 19, 2026 01:51 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 1448254 to aaea08a Compare September 22, 2026 19:00

renovate Bot had a problem deploying to cloudflare-pages September 22, 2026 19:00 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from aaea08a to 07f7dde Compare September 23, 2026 20:04

renovate Bot had a problem deploying to cloudflare-pages September 23, 2026 20:04 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 07f7dde to 7705517 Compare September 24, 2026 05:12

renovate Bot had a problem deploying to cloudflare-pages September 24, 2026 05:12 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 7705517 to 2a1dbdd Compare September 25, 2026 01:16

renovate Bot had a problem deploying to cloudflare-pages September 25, 2026 01:16 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 2a1dbdd to 6c7eff2 Compare September 25, 2026 16:27

renovate Bot had a problem deploying to cloudflare-pages September 25, 2026 16:27 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 6c7eff2 to 8ecc25d Compare September 30, 2026 00:05

renovate Bot had a problem deploying to cloudflare-pages September 30, 2026 00:06 Failure

renovate Bot force-pushed the renovate/npm-undici-6.27.0-vulnerability branch from 8ecc25d to 164ee36 Compare October 1, 2026 04:19

renovate Bot had a problem deploying to cloudflare-pages October 1, 2026 04:19 Failure

chore(deps): update dependency undici@<6.27.0 to v8 [security]

abc4446

Navigation Menu

Repository navigation

chore(deps): update dependency undici@<6.27.0 to v8 [security] - #191

chore(deps): update dependency undici@<6.27.0 to v8 [security]#191
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-undici-6.27.0-vulnerability

renovate Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Details

Summary

Impact

Shared-cache disclosure

Parse-time crash

Details

Patches

Workarounds

Credit

Severity

References

undici vulnerable to downstream response desynchronization via retry interceptor

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to CRLF Injection via blob-like body 'type' property

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to caching and replay of unsafe HTTP method responses

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to downstream response splitting via retry interceptor

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Details

Impact

Patches

Workarounds

Severity

References

undici vulnerable to Denial of Service via orphaned RetryHandler response body

Details

renovate Bot commented Aug 4, 2026 •

edited

Loading

`v8.10.2`

`v8.10.1`

`v8.10.0`

cloudflare-workers-and-pages Bot commented Aug 4, 2026 •

edited

Loading