An open index of dependabot pull requests across open source projects.

undici

Ecosystem:
npm
Package URL:
pkg:npm/undici
Total PRs:
15,509 Dependabot PRs
Latest PR:
about 6 hours ago
Unique Repositories:
9,734 repositories
Unique Repos (30 days):
160 repositories
Security Advisories
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
GHSA-9qxr-qj54-h672 CVE-2024-30261 LOW published about 2 years ago • updated 4 days ago
### Impact If an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have ...
undici Denial of Service attack via bad certificate data
GHSA-cxrh-j4jr-qwg3 CVE-2025-47279 LOW published about 1 year ago • updated 1 day ago
### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certifi...
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
GHSA-f772-66g8-q5h3 CVE-2022-35948 MODERATE published almost 4 years ago • updated about 2 months ago
### Impact `=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specificall...
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
GHSA-phc3-fgpg-7m6h CVE-2026-2581 MODERATE published 3 months ago • updated 28 days ago
## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici vers...
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH published 3 months ago • updated 20 days ago
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` para...
Recent PRs
Bump undici and wrangler

unixfy/alexwang.net #217

7.18.2 → 7.24.8 Minor PR
Closed 5 days ago 1 comment
unixfy
Bump undici from 7.25.0 to 8.4.1

Orsino404/1 #108

7.25.0 → 8.4.1 Major PR
Closed 8 days ago 3 comments
Orsino404
Package Details
Name: undici
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/undici
JSON API: View JSON
Security Advisories

22

Active advisories
HIGH 5
MODERATE 10
LOW 7
View All npm Advisories
Package Information
Description:

An HTTP/1.1 client, written from scratch for Node.js

Repository: https://github.com/nodejs/undici
Homepage: https://undici.nodejs.org
Latest Release: 7.10.0
about 1 year ago
Dependent Repos: 98,048
Dependent Packages: 1,956
Downloads: 76,040,467
Ranking: Top 0.1008% by dependent repos Top 0.0472% by downloads Top 0.0399% by dependent pkgs
PR Status
Open 7,075 (45.6%)
Merged 2,108 (13.6%)
Closed 4,636 (29.9%)
PR Types
Major 1,145 (7.4%)
Minor 9,816 (63.3%)
Patch 2,519 (16.2%)
Removal 289 (1.9%)