undici 6.26.0

Direct Vulnerabilities

Known vulnerabilities in the undici package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L CRLF Injection undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to CRLF Injection via the `writeH1` path in `lib/dispatcher/client-h1.js`. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose `.type` contains `\r\n` when an application sends it through `request()`, `stream()`, `pipeline()`, or `dispatch()` without an explicit `content-type` header. The vulnerable code copies `body.type` directly into the outgoing `content-type` header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user. How to fix CRLF Injection? Upgrade `undici` to version 6.28.0, 7.29.0, 8.9.0 or higher.	<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0
M HTTP Request Smuggling undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling due to the `interceptors.retry()` flow in `lib/handler/retry-handler.js`. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the `Content-Length` header by sending a partial `206` response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization. How to fix HTTP Request Smuggling? Upgrade `undici` to version 6.28.0, 7.29.0, 8.9.0 or higher.	<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0
M Improper Neutralization undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Neutralization via unsanitized `domain` handling and `unparsed` attribute serialization in `lib/web/cookies/util.js`. An attacker can inject or override cookie attributes by supplying a crafted `domain` such as `example.com; SameSite=None` or an `unparsed` entry such as `X-Custom=val; HttpOnly` to `setCookie`. When applications pass user-controlled tenant or routing data into these fields, the serialized `Set-Cookie` header can carry attacker-chosen flags like `SameSite`, `Secure`, or `HttpOnly`. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie. How to fix Improper Neutralization? Upgrade `undici` to version 6.28.0, 7.29.0, 8.9.0 or higher.	<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0
H Permissive List of Allowed Inputs undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the `Set-Cookie` attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests. Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute. How to fix Permissive List of Allowed Inputs? Upgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.	<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0
M Time-of-check Time-of-use (TOCTOU) Race Condition undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server. Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.	<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0
C CRLF Injection undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to CRLF Injection in the `parseSetCookie`. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning. Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization. How to fix CRLF Injection? Upgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.	<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0

Vulnerability

Vulnerable Version

CRLF Injection

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.

How to fix CRLF Injection?

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0

HTTP Request Smuggling

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.

How to fix HTTP Request Smuggling?

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0

Improper Neutralization

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Neutralization via unsanitized domain handling and unparsed attribute serialization in lib/web/cookies/util.js. An attacker can inject or override cookie attributes by supplying a crafted domain such as example.com; SameSite=None or an unparsed entry such as X-Custom=val; HttpOnly to setCookie. When applications pass user-controlled tenant or routing data into these fields, the serialized Set-Cookie header can carry attacker-chosen flags like SameSite, Secure, or HttpOnly. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie.

How to fix Improper Neutralization?

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

<6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0

Permissive List of Allowed Inputs

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

How to fix Permissive List of Allowed Inputs?

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0

Time-of-check Time-of-use (TOCTOU) Race Condition

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0

CRLF Injection

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

How to fix CRLF Injection?

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

<6.27.0>=7.0.0 <7.28.0>=8.0.0 <8.5.0

undici@6.26.0

An HTTP/1.1 client, written from scratch for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically