An open index of dependabot pull requests across open source projects.

undici

Ecosystem:
npm
Package URL:
pkg:npm/undici
Total PRs:
15,471 Dependabot PRs
Latest PR:
about 8 hours ago
Unique Repositories:
9,713 repositories
Unique Repos (30 days):
176 repositories
Security Advisories
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH published 3 months ago • updated 15 days ago
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` para...
undici Denial of Service attack via bad certificate data
GHSA-cxrh-j4jr-qwg3 CVE-2025-47279 LOW published about 1 year ago • updated 2 days ago
### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certifi...
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
GHSA-f772-66g8-q5h3 CVE-2022-35948 MODERATE published almost 4 years ago • updated about 1 month ago
### Impact `=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specificall...
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
GHSA-q768-x9m6-m9qp CVE-2022-31151 LOW published almost 4 years ago • updated about 1 month ago
### Impact Authorization headers are already cleared on cross-origin redirect in https://github.com/nodejs/undici/blob/main/lib/handler/redirect.j...
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
GHSA-g9mf-h72j-4rw9 CVE-2026-22036 MODERATE published 5 months ago • updated 3 days ago
### Impact The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, b...
Recent PRs
Bump undici and wrangler

unixfy/alexwang.net #217

7.18.2 → 7.24.8 Minor PR
Closed about 9 hours ago 1 comment
unixfy
Bump undici from 7.24.7 to 8.3.0

ecies/js #898

7.24.7 → 8.3.0 Major PR
Open 10 days ago 2 comments
ecies
Package Details
Name: undici
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/undici
JSON API: View JSON
Security Advisories

22

Active advisories
HIGH 5
MODERATE 10
LOW 7
View All npm Advisories
Package Information
Description:

An HTTP/1.1 client, written from scratch for Node.js

Repository: https://github.com/nodejs/undici
Homepage: https://undici.nodejs.org
Latest Release: 7.10.0
about 1 year ago
Dependent Repos: 98,048
Dependent Packages: 1,956
Downloads: 76,040,467
Ranking: Top 0.1008% by dependent repos Top 0.0472% by downloads Top 0.0399% by dependent pkgs
PR Status
Open 7,063 (45.7%)
Merged 2,108 (13.6%)
Closed 4,610 (29.8%)
PR Types
Major 1,137 (7.3%)
Minor 9,788 (63.3%)
Patch 2,517 (16.3%)
Removal 289 (1.9%)