An open index of dependabot pull requests across open source projects.

undici

Ecosystem:
npm
Package URL:
pkg:npm/undici
Total PRs:
15,461 Dependabot PRs
Latest PR:
about 6 hours ago
Unique Repositories:
9,707 repositories
Unique Repos (30 days):
192 repositories
Security Advisories
undici Denial of Service attack via bad certificate data
GHSA-cxrh-j4jr-qwg3 CVE-2025-47279 LOW published about 1 year ago • updated about 8 hours ago
### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certifi...
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
GHSA-f772-66g8-q5h3 CVE-2022-35948 MODERATE published almost 4 years ago • updated about 1 month ago
### Impact `=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specificall...
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
GHSA-3787-6prv-h9w3 CVE-2024-24758 LOW published over 2 years ago • updated about 23 hours ago
### Impact Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. ### Patches ...
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH published 3 months ago • updated 13 days ago
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` para...
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
GHSA-q768-x9m6-m9qp CVE-2022-31151 LOW published almost 4 years ago • updated about 1 month ago
### Impact Authorization headers are already cleared on cross-origin redirect in https://github.com/nodejs/undici/blob/main/lib/handler/redirect.j...
Recent PRs
Bump undici from 7.24.7 to 8.3.0

ecies/js #898

7.24.7 → 8.3.0 Major PR
Open 8 days ago 2 comments
ecies
Package Details
Name: undici
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/undici
JSON API: View JSON
Security Advisories

22

Active advisories
HIGH 5
MODERATE 10
LOW 7
View All npm Advisories
Package Information
Description:

An HTTP/1.1 client, written from scratch for Node.js

Repository: https://github.com/nodejs/undici
Homepage: https://undici.nodejs.org
Latest Release: 7.10.0
about 1 year ago
Dependent Repos: 98,048
Dependent Packages: 1,956
Downloads: 76,040,467
Ranking: Top 0.1008% by dependent repos Top 0.0472% by downloads Top 0.0399% by dependent pkgs
PR Status
Open 7,060 (45.7%)
Merged 2,108 (13.6%)
Closed 4,603 (29.8%)
PR Types
Major 1,134 (7.3%)
Minor 9,781 (63.3%)
Patch 2,517 (16.3%)
Removal 289 (1.9%)