fix(deps): update dependency undici to v6 [security] by renovate[bot] · Pull Request #1820 · 1-Platform/one-platform

renovate · 2026-10-03T23:30:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`^5.0.0` → `^6.0.0`

ProxyAgent vulnerable to MITM

CVE-2022-32210 / GHSA-pgw7-wx7w-2w33

More information

Details

Description

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Impact

This affects all use of HTTPS via HTTP proxy using Undici.ProxyAgent with Undici or Node's global fetch. In this case, it removes all HTTPS security from all requests sent using Undici's ProxyAgent, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy).

Patches

This issue was patched in Undici v5.5.1.

Workarounds

At the time of writing, the only workaround is to not use ProxyAgent as a dispatcher for TLS Connections.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

CVE-2022-31151 / GHSA-q768-x9m6-m9qp

More information

Details

Impact

Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.

However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in v5.8.0.

Workarounds

By default, this vulnerability is not exploitable.
Do not enable redirections, i.e. maxRedirections: 0 (the default).

References

https://hackerone.com/reports/1635514
https://curl.se/docs/CVE-2018-1000007.html
https://curl.se/docs/CVE-2022-27776.html

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici before v5.8.0 vulnerable to CRLF injection in request headers

CVE-2022-31150 / GHSA-3cvr-822r-rqcc

More information

Details

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

CVE-2022-35949 / GHSA-8qr4-xgw6-wmr3

More information

Details

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in undici@5.8.1.

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

CVE-2022-35948 / GHSA-f772-66g8-q5h3

More information

Details

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

http://localhost:3000/
http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

CRLF Injection in Nodejs ‘undici’ via host

CVE-2023-23936 / GHSA-5r9g-qh6m-jxff

More information

Details

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

Severity

CVSS Score: 4.6 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Regular Expression Denial of Service in Headers

CVE-2023-24807 / GHSA-r6ch-mqf9-qc9w

More information

Details

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici's cookie header not cleared on cross-origin redirect in fetch

CVE-2023-45143 / GHSA-wqq4-5wpv-mx2g

More information

Details

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

CVE-2024-24758 / GHSA-3787-6prv-h9w3

More information

Details

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

CVE-2024-30261 / GHSA-9qxr-qj54-h672

More information

Details

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Severity

CVSS Score: 2.6 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

CVE-2024-30260 / GHSA-m4v8-wqvr-p9f7

More information

Details

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Use of Insufficiently Random Values in undici

CVE-2025-22150 / GHSA-c76h-2ccp-4975

More information

Details

Impact

Undici fetch() uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.

If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.

Patches

This is fixed in 5.28.5; 6.21.1; 7.2.3.

Workarounds

Do not issue multipart requests to attacker controlled servers.

References

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

undici Denial of Service attack via bad certificate data

CVE-2025-47279 / GHSA-cxrh-j4jr-qwg3

More information

Details

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

Severity

CVSS Score: 3.1 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

CVE-2026-22036 / GHSA-g9mf-h72j-4rw9

More information

Details

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici)

What's Changed

fix: fix wrong stream canceled up after cloning (v6) by @snyamathi in #4414
[Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @github-actions[bot] in #4432
feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180) by @metcoder95 in #4433
feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) (#4340) by @metcoder95 in #4445
Backport 4472 to v6.x by @Uzlopak in #4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

`v6.21.3`

Compare Source

What's Changed

[Backport v6.x] append crlf to formdata body by @github-actions in #4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

`v6.21.2`

Compare Source

What's Changed

fix(types): add missing DNS interceptor by @slagiewka in #4024
[v6.x] fix wpts on windows by @mcollina in #4093
Removed clients with unrecoverable errors from the Pool #4088

New Contributors

@slagiewka made their first contribution in #4024

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

`v6.21.1`

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

fix(#3736): back-port 183f8e9 to v6.x by @ggoodman in #3855
fix(#3817): send servername for SNI on TLS (#3821) [backport] by @metcoder95 in #3864
fix: sending formdata bodies with http2 (#3863) [backport] by @metcoder95 in #3866
[Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @github-actions in #3877
types: [backport] Update return type of RetryCallback (#3851) by @metcoder95 in #3876

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

`v6.21.0`

Compare Source

What's Changed

[Backport v6.x] web: mark as uncloneable when possible (#3709) by @jazelly in #3744
[Backport v6.x] fetch: fix content-encoding order by @github-actions in #3764
[Backport v6.x] fix: handle undefined deref() of WeakRef(socket) by @github-actions in #3822
[Backport v6.x] fix: range end is zero-indexed by @github-actions in #3827

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

`v6.20.1`

Compare Source

What's Changed

[Backport v6.x] jsdoc: add jsdoc to lib/web/fetch/constants.js by @github-actions in #3710
[Backport v6.x] feat: implement BodyReadable.bytes by @github-actions in #3711
fix: add more expectsPayload methods by @ronag in #3715
[Backport v6.x] chore(H2): onboard H2 into Undici queueing system (#3707) by @Uzlopak in #3724
[Backport v6.x] fix: PoolBase kClose and kDestroy should await and not return the Promise by @github-actions in #3723
[Backport v6.x] fix: extract noop everywhere by @Uzlopak in #3727

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

`v6.20.0`

Compare Source

What's Changed

Remove patched dom types (v6.x branch) by @eXhumer in #3531
docs(Backport v6.x): Fix signature of RetryHandler by @github-actions in #3594
deps(dev): update @types/node by @metcoder95 in #3618
fix: throw on retry when payload is consume by downstream by @github-actions in #3596
feat(Backport v6.x): move throwOnError to interceptor by @github-actions in #3595
[Backport v6.x] fix: reduce memory usage in client-h1 by @github-actions in #3672
[Backport v6.x] fix: refactor fast timers, fix UND_ERR_CONNECT_TIMEOUT on event loop blocking by @github-actions in #3673
[Backport v6.x] fix: run asserts first if possible by @github-actions in #3674
[Backport v6.x] fix: use fasttimers for all connection timeouts by @github-actions in #3675
[Backport v6.x] ci: less flaky test/request-timeout.js test by @github-actions in #3678
[Backport v6.x] test: less flaky timers acceptance test, rework fast timer tests to pass them faster by @github-actions in #3679
[Backport v6.x] ignore leading and trailing crlfs in formdata body by @github-actions in #3681
[Backport v6.x] mock: fix mocking of Uint8Array and ArrayBuffers as provided mock-responses by @github-actions in #3689
[Backport v6.x] handle body errors by @Uzlopak in #3700

Full Changelog: nodejs/undici@v6.19.8...v6.20.0

What's Changed

fix #3337 by @KhafraDev in #3338
build: use husky as husky install is deprecated by @jazelly in #3340
fix: interceptors.d.ts has no default export by @Uzlopak in #3332

Full Changelog: nodejs/undici@v6.19.1...v6.19.2

`v6.19.1`

Compare Source

What's Changed

don't append empty origin by @KhafraDev in #3335

Full Changelog: nodejs/undici@v6.19.0...v6.19.1

`v6.19.0`

Compare Source

What's Changed

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #3305
build(deps): bump codecov/codecov-action from 4.3.1 to 4.4.1 by @dependabot in #3303
build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0 by @dependabot in #3304
build(deps): bump github/codeql-action from 3.25.3 to 3.25.7 by @dependabot in #3306
build(deps): bump node from 9e8f45f to dd7e693 in /build by @dependabot in #3309
build(deps): bump node from dd7e693 to e6d4495 in /build by @dependabot in #3313
remove websocket experimental warning by @KhafraDev in #3311
perf: optimization of request instantiation by @tsctx in #3107
perf: convert object to params by @DarkGL in #3302
build(deps-dev): bump borp from 0.14.0 to 0.15.0 by @dependabot in #3320
build(deps-dev): bump c8 from 9.1.0 to 10.0.0 by @dependabot in #3321
fix: add missing error classes to types by @maxbeatty in #3316
export interceptor to type def file by @jakecastelli in #3318
build(deps): bump node from e6d4495 to 075a5cc in /build by @dependabot in #3326
doc: clearify the behaviour of bodyTimeout in the request by @jakecastelli in #3324
feature: support pre-shared sessions by @tastypackets in #3325

New Contributors

@maxbeatty made their first contribution in #3316
@jakecastelli made their first contribution in #3318

Full Changelog: nodejs/undici@v6.18.2...v6.19.0

`v6.18.2`

Compare Source

What's Changed

don't use internal header state for cookies by @KhafraDev in #3295
build(deps-dev): bump borp from 0.13.0 to 0.14.0 by @dependabot in #3298
fix: retry on body support by @metcoder95 in #3294

Full Changelog: nodejs/undici@v6.18.1...v6.18.2

`v6.18.1`

Compare Source

What's Changed

docs: Update references to dispatcher in docs by @haikyuu in #3281
fix: compatibility for global headers by @tsctx in #3286
websocket: pre-calculated length by @tsctx in #3284
ci: fix autobahn workflow by @Uzlopak in #3291
revert: "websocket: pre-calculated length" by @KhafraDev in #3290
websocket: use FixedQueue instead of Set by @tsctx in #3283

New Contributors

@haikyuu made their first contribution in #3281

Full Changelog: nodejs/undici@v6.18.0...v6.18.1

`v6.18.0`

Compare Source

What's Changed

permessage-deflate decompression support in websocket by @KhafraDev in #3263
fix: Fix server closing in tests. by @ShogunPanda in #3279

Full Changelog: nodejs/undici@v6.17.0...v6.18.0

`v6.17.0`

Compare Source

What's Changed

fetch: fix captureStackTrace by @Uzlopak in #3227
fetch: fix wpt test request-upload.any.js by @Uzlopak in #3234
websocket: don't clone buffer by @tsctx in #3240
Remove unecessary async from writeBuffer by @DarkGL in #3245
refactor we

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency undici to v6 [security]

dfa3e7c

Navigation Menu

Repository navigation

fix(deps): update dependency undici to v6 [security] - #1820

fix(deps): update dependency undici to v6 [security]#1820
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-undici-vulnerability

renovate Bot commented Oct 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 3, 2026

ProxyAgent vulnerable to MITM

Details

Description

Impact

Patches

Workarounds

Severity

References

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

Details

Impact

Patches

Workarounds

References

For more information

Severity

References

undici before v5.8.0 vulnerable to CRLF injection in request headers

Details

Impact

Patches

Workarounds

References

For more information

Severity

References

undici.request vulnerable to SSRF using absolute URL on pathname

Details

Impact

Patches

Workarounds

For more information

Severity

References

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Details

Impact

Patches

Workarounds

For more information

Severity

References

CRLF Injection in Nodejs ‘undici’ via host

Details

Impact

Patches

Workarounds

References

Credits

Severity

References

Regular Expression Denial of Service in Headers

Details

Impact

Patches

Workarounds

References

Credits

Severity

References

Undici's cookie header not cleared on cross-origin redirect in fetch

Details

Impact

Patches

Severity

References

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

Details

Impact

Patches

Workarounds

References

Severity

References

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Details

Impact

Patches

`undici.request` vulnerable to SSRF using absolute URL on `pathname`