chore(deps): update dependency undici@<6.28.0 to v6.29.1 [security] - #6433

Details

Impact

Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).

For example, a 404 Not Found with Content-Length: 2 that sends one byte then closes can be resumed with an open-ended Range request, and the resumed 206 Partial Content bytes are appended, so the application receives more than two body bytes while still seeing Content-Length: 2. The bug requires interceptors.retry() enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate Content-Length.

Patches

Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.

Workarounds

• Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0.
• Remove or recalculate Content-Length before forwarding a response body assembled by Undici.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r
• https://nvd.nist.gov/vuln/detail/CVE-2026-18540
• https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329
• https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95
• https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548
• https://hackerone.com/reports/3900104
• https://hackerone.com/reports/3900615
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v6.28.1
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2
• https://github.com/advisories/GHSA-r53p-7pc4-xj5r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection. undici 6.x, 7.x, and 8.x are affected.

Patches

Upgrade to 6.29.1, 7.30.1, or 8.12.2. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.

Workarounds

None.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
• https://nvd.nist.gov/vuln/detail/CVE-2026-109869
• https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429
• https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436
• https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/releases/tag/v6.29.1
• https://github.com/nodejs/undici/releases/tag/v7.30.1
• https://github.com/nodejs/undici/releases/tag/v8.12.2
• https://github.com/advisories/GHSA-xjj6-f33q-929c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v6.29.1

Compare Source

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• [v6.x] fix(fetch): fix aborting Streams (#​3754) by @​mrityunjay-pandey in #​6000

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

v6.29.0

Compare Source

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in #​5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in #​5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in #​5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

Compare Source

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#​5032) by @​mcollina in #​5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#​5707) by @​mcollina in #​5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1