An open index of dependabot pull requests across open source projects.

undici

Ecosystem:
npm
Package URL:
pkg:npm/undici
Total PRs:
15,466 Dependabot PRs
Latest PR:
about 7 hours ago
Unique Repositories:
9,710 repositories
Unique Repos (30 days):
182 repositories
Security Advisories
undici Denial of Service attack via bad certificate data
GHSA-cxrh-j4jr-qwg3 CVE-2025-47279 LOW published about 1 year ago • updated about 17 hours ago
### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certifi...
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
GHSA-f772-66g8-q5h3 CVE-2022-35948 MODERATE published almost 4 years ago • updated about 1 month ago
### Impact `=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specificall...
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
GHSA-q768-x9m6-m9qp CVE-2022-31151 LOW published almost 4 years ago • updated about 1 month ago
### Impact Authorization headers are already cleared on cross-origin redirect in https://github.com/nodejs/undici/blob/main/lib/handler/redirect.j...
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
GHSA-g9mf-h72j-4rw9 CVE-2026-22036 MODERATE published 5 months ago • updated 2 days ago
### Impact The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, b...
Use of Insufficiently Random Values in undici
GHSA-c76h-2ccp-4975 CVE-2025-22150 MODERATE published over 1 year ago • updated 5 days ago
### Impact [Undici `fetch()` uses Math.random()](https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body...
Recent PRs (filtered by: Patch PRs )
Bump undici from 7.24.4 to 7.24.8

wlnbing/5556 #88

7.24.4 → 7.24.8 Patch PR
Open about 2 months ago 2 comments
wlnbing
Bump undici from 7.24.4 to 7.24.7

wlnbing/5556 #53

7.24.4 → 7.24.7 Patch PR
Closed 2 months ago 3 comments
wlnbing
Bump undici from 7.24.4 to 7.24.6

wlnbing/5556 #38

7.24.4 → 7.24.6 Patch PR
Open 3 months ago 3 comments
wlnbing
Package Details
Name: undici
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/undici
JSON API: View JSON
Security Advisories

22

Active advisories
HIGH 5
MODERATE 10
LOW 7
View All npm Advisories
Package Information
Description:

An HTTP/1.1 client, written from scratch for Node.js

Repository: https://github.com/nodejs/undici
Homepage: https://undici.nodejs.org
Latest Release: 7.10.0
about 1 year ago
Dependent Repos: 98,048
Dependent Packages: 1,956
Downloads: 76,040,467
Ranking: Top 0.1008% by dependent repos Top 0.0472% by downloads Top 0.0399% by dependent pkgs
PR Status
Open 7,061 (45.7%)
Merged 2,108 (13.6%)
Closed 4,607 (29.8%)
PR Types
Major 1,135 (7.3%)
Minor 9,785 (63.3%)
Patch 2,517 (16.3%)
Removal 289 (1.9%)