Changes Scan Docs Trust

← All changes

When upstream breaks, Teire fixes your code.

teire-dev/teire System status

Built on

Product

Scan a repo Changes Install on GitHub Dashboard Demo video

Developers

Docs GitHub CLI and MCP teire.yml schema npm

Trust

How Teire runs Source code

undici (npm) · Teire

Changes Scan Docs Trust

undici

npm

latest 8.12.4 · 2026-11-05www.npmjs.com · all 317 versions

Security advisories41

undici: undici vulnerable to response truncation via oversized chunked responses in the dump interceptorfixed in 7.29.1, 8.10.2
undici: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesfixed in 7.29.1, 8.10.2
undici: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agentfixed in 6.29.1, 7.30.1, 8.12.2
undici: Undici has an HTTP Request/Response Smuggling issuefixed in 6.24.0, 7.24.0

Versions that change something

6.28.12026-09fixes 3 advisories
6.29.12026-10fixes 5 advisories
7.2.32025-01fixes 1 advisory
7.5.02025-03fixes 1 advisory

undici: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

fixed in 6.27.0, 7.28.0, 8.5.0

undici: Undici proxy-authorization header not cleared on cross-origin redirect in fetchfixed in 5.28.3, 6.6.1

undici: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionfixed in 6.28.1, 7.29.1, 8.10.2

undici: undici vulnerable to Denial of Service via unbounded decompression of compressed responsesfixed in 7.29.1, 8.10.2

undici: Undici has CRLF Injection in undici via `upgrade` optionfixed in 6.24.0, 7.24.0

undici: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesfixed in 7.29.0, 8.9.0

undici: undici vulnerable to Denial of Service via unbounded memory in the EventSource parserfixed in 6.29.1, 7.30.1, 8.12.2

undici: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsfixed in 7.30.1, 8.12.2

undici: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorfixed in 7.30.1, 8.12.2

undici: CRLF Injection in Nodejs ‘undici’ via hostfixed in 5.19.1

undici: undici vulnerable to caching and replay of unsafe HTTP method responsesfixed in 7.29.1, 8.10.2

undici: undici vulnerable to downstream response desynchronization via retry interceptorfixed in 6.28.0, 7.29.0, 8.9.0

undici: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingfixed in 6.29.1, 7.30.1, 8.12.2

undici: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectfixed in 5.28.4, 6.11.1

undici: Use of Insufficiently Random Values in undicifixed in 5.28.5, 6.21.1, 7.2.3

undici: undici Denial of Service attack via bad certificate datafixed in 5.29.0, 6.21.2, 7.5.0

undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the clientfixed in 6.24.0, 7.24.0

undici: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensfixed in 7.30.1, 8.12.2

undici: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingfixed in 6.27.0, 7.28.0, 8.5.0

undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionfixed in 7.18.2, 6.23.0

undici: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesfixed in 7.29.0, 8.9.0

undici: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelinefixed in 5.28.4, 6.11.1

undici: undici vulnerable to CRLF Injection via blob-like body 'type' propertyfixed in 6.28.0, 7.29.0, 8.9.0

undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decodingfixed in 6.27.0, 7.28.0, 8.5.0

undici: undici vulnerable to Denial of Service via orphaned RetryHandler response bodyfixed in 7.29.1, 8.10.2

undici: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationfixed in 6.29.1, 7.30.1, 8.12.2

undici: undici vulnerable to downstream response splitting via retry interceptorfixed in 6.28.1, 7.29.1, 8.10.2

undici: Regular Expression Denial of Service in Headersfixed in 5.19.1

undici: undici vulnerable to Denial of Service via unrequested WebSocket subprotocolfixed in 6.28.1, 7.29.1, 8.10.2

undici: undici vulnerable to Denial of Service via WebSocketStream unclean closefixed in 7.29.1, 8.10.2

undici: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsfixed in 6.28.0, 7.29.0, 8.9.0

undici: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validationfixed in 6.24.0, 7.24.0

undici: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompressionfixed in 6.24.0, 7.24.0

undici: undici WebSocket client vulnerable to denial of service via fragment count bypassfixed in 6.27.0, 7.28.0, 8.5.0

undici: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolfixed in 7.29.1, 8.10.2

undici: Undici's cookie header not cleared on cross-origin redirect in fetchfixed in 5.26.2

undici: undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsfixed in 6.29.1, 7.30.1, 8.12.2

7.18.2

2026-01

fixes 1 advisory

7.24.02026-03fixes 5 advisories

7.28.02026-06fixes 4 advisories

7.29.02026-07fixes 5 advisories

7.29.12026-09fixes 10 advisories

7.30.12026-10fixes 8 advisories

8.5.02026-06fixes 4 advisories

8.9.02026-07fixes 5 advisories

8.10.22026-09fixes 10 advisories

8.12.22026-10fixes 8 advisories