An open index of dependabot pull requests across open source projects.

undici

Ecosystem:
npm
Package URL:
pkg:npm/undici
Total PRs:
15,733 Dependabot PRs
Latest PR:
1 day ago
Unique Repositories:
9,897 repositories
Unique Repos (30 days):
32 repositories
Security Advisories
Undici has CRLF Injection in undici via `upgrade` option
GHSA-4992-7rv2-5pvq CVE-2026-1527 MODERATE published 5 months ago • updated 9 days ago
### Impact When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (...
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH published 5 months ago • updated about 7 hours ago
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` para...
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
GHSA-8qr4-xgw6-wmr3 CVE-2022-35949 MODERATE published almost 4 years ago • updated 9 days ago
### Impact `undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` optio...
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
GHSA-phc3-fgpg-7m6h CVE-2026-2581 MODERATE published 5 months ago • updated 15 days ago
## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici vers...
undici WebSocket client vulnerable to denial of service via fragment count bypass
GHSA-vxpw-j846-p89q CVE-2026-12151 HIGH published about 2 months ago • updated 2 days ago
## Impact The undici WebSocket client enforces `maxPayloadSize` on the cumulative byte count of fragments in a message but does not enforce a limi...
Recent PRs
Bump undici and wrangler

MatchaOnMuffins/HN_updates #11

7.24.8 → 7.28.0 Minor PR
Open about 1 month ago 1 comment
MatchaOnMuffins
Package Details
Name: undici
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/undici
JSON API: View JSON
Security Advisories

35

Active advisories
HIGH 10
MODERATE 16
LOW 9
View All npm Advisories
Package Information
Description:

An HTTP/1.1 client, written from scratch for Node.js

Repository: https://github.com/nodejs/undici
Homepage: https://undici.nodejs.org
Latest Release: 7.10.0
about 1 year ago
Dependent Repos: 98,048
Dependent Packages: 1,956
Downloads: 76,040,467
Ranking: Top 0.1008% by dependent repos Top 0.0472% by downloads Top 0.0399% by dependent pkgs
PR Status
Open 7,190 (45.7%)
Merged 2,108 (13.4%)
Closed 4,745 (30.2%)
PR Types
Major 1,161 (7.4%)
Minor 10,020 (63.7%)
Patch 2,519 (16.0%)
Removal 292 (1.9%)