Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Upgrade: [dependabot] - bump undici from 5.29.0 to 7.24.1

Open
Number: #139
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: April 16, 2026 at 06:12 PM UTC
(3 months ago)
Updated: April 16, 2026 at 10:21 PM UTC
(3 months ago)
Labels:
dependencies javascript
Description:

Bumps undici from 5.29.0 to 7.24.1.

Release notes

Sourced from undici's releases.

v7.24.1

What's Changed

Full Changelog: https://github.com/nodejs/undici/compare/v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

  • GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
    Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

  • GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
    Malicious WebSocket 64-bit frame length handling could crash the client.

  • GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
    Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

  • GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
    CRLF injection via the upgrade option.

  • GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
    Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

  • GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
    Unbounded memory consumption in WebSocket permessage-deflate decompression.

Affected and patched ranges

  • CVE-2026-1525: affected 7.0.0 < 7.24.0, patched 7.24.0
  • CVE-2026-1528: affected 7.0.0 < 7.24.0, patched 7.24.0
  • CVE-2026-2581: affected >= 7.17.0 < 7.24.0, patched 7.24.0
  • CVE-2026-1527: affected 7.0.0 < 7.24.0, patched 7.24.0
  • CVE-2026-2229: affected 7.0.0 < 7.24.0, patched 7.24.0
  • CVE-2026-1526: affected 7.0.0 < 7.24.0, patched 7.24.0

References

... (truncated)

Commits
  • 23e3cd3 Bumped v7.24.1
  • 3aedaa8 remove PLAN.md
  • 0d7ec33 fix: proto pollution (#4885)
  • 07a3906 Bumped v7.24.0 (#4887)
  • 74495c6 fix: reject duplicate content-length and host headers
  • 84235c6 Fix websocket 64-bit length overflow
  • 77594f9 fix: validate upgrade header to prevent CRLF injection
  • cb79c57 fix: validate server_max_window_bits range in permessage-deflate
  • 4147ce2 Merge commit '2ee00cb3'
  • 2ee00cb fix(websocket): add maxDecompressedMessageSize limit for permessage-deflate
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Package Dependencies
Package:
undici
Ecosystem:
npm
Version Change:
5.29.0 → 7.24.1
Update Type:
Major
Security Advisories
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
GHSA-vrm6-8vpv-qv8q CVE-2026-1526 HIGH
## Description The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia...
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a ...
Undici has CRLF Injection in undici via `upgrade` option
GHSA-4992-7rv2-5pvq CVE-2026-1527 MODERATE
### Impact When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to: 1. Inject arbitrary HTTP headers 2. T...
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
GHSA-phc3-fgpg-7m6h CVE-2026-2581 MODERATE
## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled...
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
GHSA-f269-vfmq-vjvj CVE-2026-1528 HIGH
### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws...
Undici has an HTTP Request/Response Smuggling issue
GHSA-2mjp-6q6p-2qxm CVE-2026-1525 MODERATE
### Impact Undici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed H...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 15350442
UUID: 4277662831
Node ID: PR_kwDOQVmwD87TEBzz
Host: GitHub
Repository: NHSDigital/eps-common-workflows