StackPrism

npm package

undici vulnerabilities by version

The latest release, 8.12.2 (Oct 15, 2026), has no known vulnerabilities. 51% of last week’s 217.5M downloads went to versions with known vulnerabilities. OSV.dev lists 46 advisories for undici; the newest was published on Sep 29, 2026.

npm (opens in a new tab) describes it as “An HTTP/1.1 client, written from scratch for Node.js”

Latest release
8.12.2
Oct 15, 2026, no known vulnerabilities
Downloads last week
217.5M
All versions, from npm
Advisories on OSV.dev
46
Newest Sep 29, 2026
Licence
MIT
OpenSSF Scorecard
8.1/10
nodejs/undici (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
7.30.0Sep 25, 2026No known vulnerabilities25.1M
7.29.1Sep 4, 2026No known vulnerabilities24.4M
8.11.2Sep 24, 2026No known vulnerabilities20.8M
7.29.0Jul 24, 202610 known vulnerabilities, worst rated critical19.9M
6.29.0Sep 25, 2026No known vulnerabilities16.8M
5.29.0Mar 19, 202513 known vulnerabilities, worst rated critical14.3M
7.28.0Jun 15, 202615 known vulnerabilities, worst rated critical10.5M
8.10.2Sep 4, 2026No known vulnerabilities10.4M

Who is still on a vulnerable undici

51% of last week’s 217.5M undici downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. undici doesn’t publish support dates we can check.

LineNewest releaseReleased
88.12.2Oct 15, 2026
77.30.1Oct 15, 2026
66.29.1Oct 15, 2026
55.29.0Mar 19, 2025
44.16.0Mar 18, 2022
33.3.6Apr 24, 2021

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-18149 on OSV.dev (opens in a new tab)GHSA-pmjh-fq2x-6v4x

    undici vulnerable to Denial of Service via orphaned RetryHandler response body

    Affects >= 7.11.0, < 7.29.1; >= 8.0.0, < 8.10.2. Published Sep 29, 2026.

  2. LowCVE-2026-18540 on OSV.dev (opens in a new tab)GHSA-r53p-7pc4-xj5r

    undici vulnerable to downstream response splitting via retry interceptor

    Affects < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2. Published Sep 29, 2026.

  3. CriticalCVE-2026-19534 on OSV.dev (opens in a new tab)GHSA-rfgv-xxqx-mfg5

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    Affects >= 6.7.0, < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2. Published Sep 29, 2026.

  4. WarningCVE-2026-84890 on OSV.dev (opens in a new tab)GHSA-3xpg-4rpp-hhhm

    undici vulnerable to Denial of Service via unbounded decompression of compressed responses

    Affects >= 7.15.0, < 7.29.1; >= 8.0.0, < 8.10.2. Published Sep 29, 2026.

  5. WarningCVE-2026-84933 on OSV.dev (opens in a new tab)GHSA-2jfj-6hjv-fm6j

    undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

    Affects >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2. Published Sep 29, 2026.

All 46 advisories are on OSV.dev (opens in a new tab).

Which undici do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for undici, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.