You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Snyk has created this PR to upgrade undici from 7.28.0 to 8.6.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 11 versions ahead of your current version.
WebSocket DoS via fragment count bypass — CVE-2026-12151
GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix:32dbf0b3websocket: limit the number of fragments in a message (also c5ed7875handle empty fragments and stream limits)
A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.
Affected: applications using new WebSocket(...) or WebSocketStream
against untrusted endpoints.
Workaround: none — upgrade is required.
WebSocket DoS via cumulative fragment bypass — CVE-2026-9675
GHSA-38rv-x7px-6hhq · CWE-400, CWE-770 Fix:b4c287b3fix(websocket): enforce max payload size across fragments
Undici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).
Workaround: none — upgrade is required.
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697
The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.
Affected:ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on requestTls.
Workaround: route traffic through an HTTP-proxy ProxyAgent, where requestTls functions correctly.
Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734
GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0 Fix:a516f870fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)
Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.
Affected: applications using Socks5ProxyAgent across multiple origins
(introduced via #4385).
Workaround: use a separate agent instance per origin.
Moderate severity
Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678
The cache interceptor mishandled responses with whitespace-padded Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.
Affected: apps using the cache interceptor in shared mode that forward Authorization upstream and receive non-canonical qualified directives.
Workaround: disable shared-cache mode for authenticated traffic, avoid
caching authenticated responses, or add Vary: Authorization upstream.
HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679
parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via #3789.
Workaround: sanitize values before forwarding — strip or reject CR, LF,
NUL, ;, and =.
The cookie parser accepted SameSite values containing Strict, Lax, or None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.
HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733
GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition) Fix:6ea54ef8fix: guard idle socket validation to skip fresh sockets, hardened by c9fbe9d2keep idle validation on native timers (#5397) and ac5394b8keep idle validation on global timers (#5407)
An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.
Requirements: attacker-controlled/compromised upstream and active
keep-alive reuse.
Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
Client or Pool.
Also in v8.5.0 (non-security)
v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #5397
and #5407, are covered under CVE-2026-6733 above and are not repeated here.)
HTTP/2:#5408 don't rewind kPendingIdx past in-flight requests · #5391 allow h2 POST request multiplexing · #5406 reap idle HTTP/2 sessions · #5410 preserve h2 queue on out-of-order completion
Features:#5416 add bodyMixin.textStream() · #5418 align EventSource with spec
Docs / CI / tests:#5413 document request header validation · #5383 absorb h2 stream timeout resets (test) · #5420 remove stale repro + lint · #5426 extend Windows CI timeout · #5427 detect available python in WPT runner
This is a major version upgrade from v7 to v8 that introduces significant breaking changes requiring developer action.
Key Breaking Changes:
Node.js Version Requirement: Undici v8 requires Node.js version 22.19.0 or newer. Environments using older Node.js versions (including Node 20) must be upgraded.
HTTP/2 Enabled by Default: HTTP/2 is now enabled by default when the server negotiates it. Applications that depend on HTTP/1.1-specific behavior must be updated to explicitly set allowH2: false in the client or pool options to maintain the previous behavior.
Dispatcher Handler API: Legacy dispatcher handlers (onConnect, onHeaders, onComplete) have been removed. Any custom dispatchers, interceptors, or wrappers must be migrated to the new v2 handler API.
Internal API Changes: The internal symbol for the global dispatcher has changed. Code should only rely on the public setGlobalDispatcher() and getGlobalDispatcher() APIs.
Recommendation:
This upgrade requires careful validation. Developers must first ensure their environment meets the new Node.js version requirement. Review any custom dispatcher or interceptor implementations and migrate them to the new v2 API. Test application behavior related to HTTP/2 negotiation.
Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.
ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.
Check Type
Count (with fixes)
Without fixes
Threshold
Result
🔴 Critical Severity
0
0
10
✅ Passed
🟠 High Severity
0
0
25
✅ Passed
🟡 Medium Severity
0
0
500
✅ Passed
🔵 Low Severity
0
0
1000
✅ Passed
⏱️ SLA Breach Summary
✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.
Severity
Breaches (with fixes)
Breaches (no fixes)
SLA Threshold (with/no fixes)
Status
🔴 Critical
0
0
15 / 30 days
✅ Passed
🟠 High
0
0
30 / 120 days
✅ Passed
🟡 Medium
0
0
90 / 365 days
✅ Passed
🔵 Low
0
0
180 / 365 days
✅ Passed
✅ BUILD PASSED - All security checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade undici from 7.28.0 to 8.6.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 11 versions ahead of your current version.
The recommended version was released 22 days ago.
Breaking Change Risk
Release notes
Package name: undici
What's Changed
New Contributors
Full Changelog: v8.5.0...v8.6.0
This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.
Summary
32dbf0b3b4c287b342d49559a516f870cb105d7c5655ea435655ea436ea54ef8High severity
WebSocket DoS via fragment count bypass — CVE-2026-12151
GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix:
32dbf0b3websocket: limit the number of fragments in a message (alsoc5ed7875handle empty fragments and stream limits)A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.
new WebSocket(...)orWebSocketStreamagainst untrusted endpoints.
WebSocket DoS via cumulative fragment bypass — CVE-2026-9675
GHSA-38rv-x7px-6hhq · CWE-400, CWE-770
Fix:
b4c287b3fix(websocket): enforce max payload size across fragmentsUndici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697
GHSA-vmh5-mc38-953g · CWE-295
Fix:
42d49559fix: honor requestTls when proxy is SOCKS5The
ProxyAgentsilently discarded therequestTlsoption when configured witha SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as
ca,cert,key,rejectUnauthorized, andservername,falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.
ProxyAgent/Socks5ProxyAgentover SOCKS5 that rely onrequestTls.ProxyAgent, whererequestTlsfunctions correctly.Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734
GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0
Fix:
a516f870fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)Socks5ProxyAgentreused a single connection pool across different originswithout verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.
Socks5ProxyAgentacross multiple origins(introduced via #4385).
Moderate severity
Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678
GHSA-pr7r-676h-xcf6 · CWE-524
Fix:
cb105d7cfix(cache): trim qualified field namesThe cache interceptor mishandled responses with whitespace-padded
Cache-Controldirectives such asprivate=" authorization". In shared-cachemode this could cause authenticated data to be cached and served to other users.
Authorizationupstream and receive non-canonical qualified directives.caching authenticated responses, or add
Vary: Authorizationupstream.HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679
GHSA-p88m-4jfj-68fv · CWE-93
Fix:
5655ea43fix(cookies): preserve values and parse SameSite strictlyparseSetCookieapplied percent-decoding to cookie values, turning encodedsequences like
%0D%0Aand%00into literal bytes, contrary to RFC 6265 §5.4and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#3789.
NUL,
;, and=.Low severity
Set-Cookie SameSite attribute downgrade — CVE-2026-11525
GHSA-g8m3-5g58-fq7m · CWE-183
Fix:
5655ea43fix(cookies): preserve values and parse SameSite strictlyThe cookie parser accepted
SameSitevalues containingStrict,Lax, orNoneas substrings rather than requiring exact matches per RFC 6265. Valueslike
SameSite=NoneOfYourBusinessparsed asNone, andSameSite=StrictLaxparsed as
Lax, silently weakening cookie security policies for apps thatforward parsed attributes.
HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733
GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix:
6ea54ef8fix: guard idle socket validation to skip fresh sockets, hardened byc9fbe9d2keep idle validation on native timers (#5397) andac5394b8keep idle validation on global timers (#5407)An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.
keep-alive reuse.
keepAliveTimeout: 0on theClient or Pool.
Also in v8.5.0 (non-security)
v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #5397
and #5407, are covered under
CVE-2026-6733 above and are not repeated here.)
#5408don't rewindkPendingIdxpast in-flight requests ·#5391allow h2 POST request multiplexing ·#5406reap idle HTTP/2 sessions ·#5410preserve h2 queue on out-of-order completion#5416addbodyMixin.textStream()·#5418align EventSource with spec#5413document request header validation ·#5383absorb h2 stream timeout resets (test) ·#5420remove stale repro + lint ·#5426extend Windows CI timeout ·#5427detect available python in WPT runnerFull changelog:
v8.4.1...v8.5.0.Credits
Per-advisory credits (as recorded in each GHSA):
What's Changed
New Contributors
Full Changelog: v8.4.0...v8.4.1
What's Changed
npm ciinstead ofnpm installby @ aduh95 in #5315addAbortListenerutil by @ aduh95 in #5317kEnumerablePropertyatomically by @ aduh95 in