chore(deps): update dependency undici@<=5.8.1 to v6 [security] #128

renovate · 2025-09-28T17:27:16Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici@<=5.8.1 (source)	`>=5.8.2` → `>=6.23.0`

GitHub Vulnerability Alerts

CVE-2023-45143

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

CVE-2024-24758

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

CVE-2024-30261

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

CVE-2024-30260

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

CVE-2025-22150

Impact

Undici fetch() uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.

If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.

Patches

This is fixed in 5.28.5; 6.21.1; 7.2.3.

Workarounds

Do not issue multipart requests to attacker controlled servers.

References

CVE-2022-31150

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

CVE-2022-31151

Impact

Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.

However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in v5.8.0.

Workarounds

By default, this vulnerability is not exploitable.
Do not enable redirections, i.e. maxRedirections: 0 (the default).

References

https://hackerone.com/reports/1635514
https://curl.se/docs/CVE-2018-1000007.html
https://curl.se/docs/CVE-2022-27776.html

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

CVE-2022-35949

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in undici@5.8.1.

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

CVE-2022-35948

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

http://localhost:3000/
http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository
To make a report, follow the SECURITY document

CVE-2023-23936

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.

CVE-2023-24807

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

CVE-2025-47279

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

Release Notes

nodejs/undici (undici@<=5.8.1)

`v6.23.0`

Compare Source

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

`v6.22.0`

Compare Source

What's Changed

fix: fix wrong stream canceled up after cloning (v6) by @snyamathi in #4414
[Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @github-actions[bot] in #4432
feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180) by @metcoder95 in #4433
feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) (#4340) by @metcoder95 in #4445
Backport 4472 to v6.x by @Uzlopak in #4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

`v6.21.3`

Compare Source

What's Changed

[Backport v6.x] append crlf to formdata body by @github-actions in #4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

`v6.21.2`

Compare Source

What's Changed

fix(types): add missing DNS interceptor by @slagiewka in #4024
[v6.x] fix wpts on windows by @mcollina in #4093
Removed clients with unrecoverable errors from the Pool #4088

New Contributors

@slagiewka made their first contribution in #4024

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

`v6.21.1`

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

fix(#3736): back-port 183f8e9 to v6.x by @ggoodman in #3855
fix(#3817): send servername for SNI on TLS (#3821) [backport] by @metcoder95 in #3864
fix: sending formdata bodies with http2 (#3863) [backport] by @metcoder95 in #3866
[Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @github-actions in #3877
types: [backport] Update return type of RetryCallback (#3851) by @metcoder95 in #3876

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

`v6.21.0`

Compare Source

What's Changed

[Backport v6.x] web: mark as uncloneable when possible (#3709) by @jazelly in #3744
[Backport v6.x] fetch: fix content-encoding order by @github-actions in #3764
[Backport v6.x] fix: handle undefined deref() of WeakRef(socket) by @github-actions in #3822
[Backport v6.x] fix: range end is zero-indexed by @github-actions in #3827

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

`v6.20.1`

Compare Source

What's Changed

[Backport v6.x] jsdoc: add jsdoc to lib/web/fetch/constants.js by @github-actions in #3710
[Backport v6.x] feat: implement BodyReadable.bytes by @github-actions in #3711
fix: add more expectsPayload methods by @ronag in #3715
[Backport v6.x] chore(H2): onboard H2 into Undici queueing system (#3707) by @Uzlopak in #3724
[Backport v6.x] fix: PoolBase kClose and kDestroy should await and not return the Promise by @github-actions in #3723
[Backport v6.x] fix: extract noop everywhere by @Uzlopak in #3727

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

`v6.20.0`

Compare Source

What's Changed

Remove patched dom types (v6.x branch) by @eXhumer in #3531
docs(Backport v6.x): Fix signature of RetryHandler by @github-actions in #3594
deps(dev): update @types/node by @metcoder95 in #3618
fix: throw on retry when payload is consume by downstream by @github-actions in #3596
feat(Backport v6.x): move throwOnError to interceptor by @github-actions in #3595
[Backport v6.x] fix: reduce memory usage in client-h1 by @github-actions in #3672
[Backport v6.x] fix: refactor fast timers, fix UND_ERR_CONNECT_TIMEOUT on event loop blocking by @github-actions in #3673
[Backport v6.x] fix: run asserts first if possible by @github-actions in #3674
[Backport v6.x] fix: use fasttimers for all connection timeouts by @github-actions in #3675
[Backport v6.x] ci: less flaky test/request-timeout.js test by @github-actions in #3678
[Backport v6.x] test: less flaky timers acceptance test, rework fast timer tests to pass them faster by @github-actions in #3679
[Backport v6.x] ignore leading and trailing crlfs in formdata body by @github-actions in #3681
[Backport v6.x] mock: fix mocking of Uint8Array and ArrayBuffers as provided mock-responses by @github-actions in #3689
[Backport v6.x] handle body errors by @Uzlopak in #3700

Full Changelog: nodejs/undici@v6.19.8...v6.20.0

What's Changed

fix #3337 by @KhafraDev in #3338
build: use husky as husky install is deprecated by @jazelly in #3340
fix: interceptors.d.ts has no default export by @Uzlopak in #3332

Full Changelog: nodejs/undici@v6.19.1...v6.19.2

`v6.19.1`

Compare Source

What's Changed

don't append empty origin by @KhafraDev in #3335

Full Changelog: nodejs/undici@v6.19.0...v6.19.1

`v6.19.0`

Compare Source

What's Changed

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #3305
build(deps): bump codecov/codecov-action from 4.3.1 to 4.4.1 by @dependabot in #3303
build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0 by @dependabot in #3304
build(deps): bump github/codeql-action from 3.25.3 to 3.25.7 by @dependabot in #3306
build(deps): bump node from 9e8f45f to dd7e693 in /build by @dependabot in #3309
build(deps): bump node from dd7e693 to e6d4495 in /build by @dependabot in #3313
remove websocket experimental warning by @KhafraDev in #3311
perf: optimization of request instantiation by @tsctx in #3107
perf: convert object to params by @DarkGL in #3302
build(deps-dev): bump borp from 0.14.0 to 0.15.0 by @dependabot in #3320
build(deps-dev): bump c8 from 9.1.0 to 10.0.0 by @dependabot in #3321
fix: add missing error classes to types by @maxbeatty in #3316
export interceptor to type def file by @jakecastelli in #3318
build(deps): bump node from e6d4495 to 075a5cc in /build by @dependabot in #3326
doc: clearify the behaviour of bodyTimeout in the request by @jakecastelli in #3324
feature: support pre-shared sessions by @tastypackets in #3325

New Contributors

@maxbeatty made their first contribution in #3316
@jakecastelli made their first contribution in #3318

Full Changelog: nodejs/undici@v6.18.2...v6.19.0

`v6.18.2`

Compare Source

What's Changed

don't use internal header state for cookies by @KhafraDev in #3295
build(deps-dev): bump borp from 0.13.0 to 0.14.0 by @dependabot in #3298
fix: retry on body support by @metcoder95 in #3294

Full Changelog: nodejs/undici@v6.18.1...v6.18.2

`v6.18.1`

Compare Source

What's Changed

docs: Update references to dispatcher in docs by @haikyuu in #3281
fix: compatibility for global headers by @tsctx in #3286
websocket: pre-calculated length by @tsctx in #3284
ci: fix autobahn workflow by @Uzlopak in #3291
revert: "websocket: pre-calculated length" by @KhafraDev in #3290
websocket: use FixedQueue instead of Set by @tsctx in #3283

New Contributors

@haikyuu made their first contribution in #3281

Full Changelog: nodejs/undici@v6.18.0...v6.18.1

`v6.18.0`

Compare Source

What's Changed

permessage-deflate decompression support in websocket by @KhafraDev in #3263
fix: Fix server closing in tests. by @ShogunPanda in #3279

Full Changelog: nodejs/undici@v6.17.0...v6.18.0

`v6.17.0`

Compare Source

What's Changed

fetch: fix captureStackTrace by @Uzlopak in #3227
fetch: fix wpt test request-upload.any.js by @Uzlopak in #3234
websocket: don't clone buffer by @tsctx in #3240
Remove unecessary async from writeBuffer by @DarkGL in #3245
refactor websocket control frame handling by @KhafraDev in #3241
fix parsing continuation frames in websocket by @KhafraDev in #3247
ci: node nightly test should use node 23 by @Uzlopak in #3248
Add test to verify if the connection is correctly aborted on cancel by @mcollina in #3219
Autobahn suite by @KhafraDev in #3251
websocket: fix 6 autobahn tests by @KhafraDev in #3254
websocket: checkout correct commit in autobahn workflow by @Uzlopak in #3258
Cleanup websocket by @KhafraDev in #3257
websocket: autobahn workflow should fail on error by @Uzlopak in #3259
add bodymixin bytes by @KhafraDev in #3262
perf: avoid buffer cloning by @tsctx in #3264
feat: dump interceptor by @metcoder95 in #3118
use private properties in Headers by @KhafraDev in #3269
Revert "websocket: autobahn workflow should fail on error" by @Uzlopak in #3270
build(deps): bump node from 487dc5d to 9e8f45f in /build by @dependabot in #3271

New Contributors

@DarkGL made their first contribution in #3245

Full Changelog: nodejs/undici@v6.16.1...v6.17.0

`v6.16.1`

Compare Source

What's Changed

fix some typos by @Uzlopak in #3217
websocket: move codeblock in parseCloseBody by @Uzlopak in #3215
fetch: enable wpt test request-referrer.any.js by @Uzlopak in #3223
fetch: wpt add /fetch/api/resources/cache.py to server.mjs by @Uzlopak in #3225
add pipe support for wpt server by @KhafraDev in #3228
test: reduce the number of requests in fire-and-forget.js by @tsctx in #3229
ci: add node 22 in ci test matrix, use 22 for coverage by @Uzlopak in #3226
fetch: don't set an invalid origin header by @KhafraDev in #3235
fail wpt runner if expected failures does not match actual by @KhafraDev in #3236
fix: ignore content-length when dumping HEAD by @ronag in #3222

Full Changelog: nodejs/undici@v6.16.0...v6.16.1

`v6.16.0`

Compare Source

What's Changed

add index to sequence converter errors by @KhafraDev in #3178
build(deps-dev): bump borp from 0.12.0 to 0.13.0 by @dependabot in #3179
build(deps): bump node from 21-alpine3.19 to 22-alpine3.19 in /build by @dependabot in #3180
build(deps): bump superagent from 8.1.2 to 9.0.2 in /benchmarks by @dependabot in #3181
fix: keep raw header name by @tsctx in #3183
fix(fetch): improve Headers and Request type-compatibility by @kettanaito in #1964
fix 3 mimesniff tests by @KhafraDev in #3185
build(deps): bump hendrikmuhs/ccache-action from 1.2.12 to 1.2.13 by @dependabot in #3187
build(deps): bump codecov/codecov-action from 4.1.1 to 4.3.1 by @dependabot in #3191
build(deps): bump github/codeql-action from 3.24.9 to 3.25.3 by @dependabot in #3192
build(deps): bump actions/dependency-review-action from 4.2.5 to 4.3.2 by @dependabot in #3189
build(deps): bump step-security/harden-runner from 2.7.0 to 2.7.1 by @dependabot in #3188
build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3 by @dependabot in #3190
build(deps): bump node from 9459e24 to 487dc5d in /build by @dependabot in #3195
perf: avoid spread in makeRequest() by @gunjam in #3193
refactor: code cleanup by @tsctx in #3194
fix parsing when receiving empty body websocket by @KhafraDev in #3205
fix: MockResponseCallbackOptions type by @merojosa in #2951
docs(proxy): fix typo by @kanadgupta in #3207
fix websocket receiving an invalid utf-8 in close frame by @KhafraDev in #3206
perf: avoid setImmediate if body is reading by @ronag in #3210
fix: request abort signal by @ronag in #3209
fix: remove abort handler on close by @ronag in #3211
fix: pass abort function by @tsctx in #3212
websocket: 200x faster generate mask by @tsctx in #3204
use FinalizationRegistry to cancel the body if response is collected by @mcollina in #3199
websocket: don't clone buffer if it's not needed. by @tsctx in #3214
websocket: use FastBuffer by @tsctx in #3213

New Contributors

@kettanaito made their first contribution in #1964
@gunjam made their first contribution in #3193
@merojosa made their first contribution in #2951
@kanadgupta made their first contribution in #3207

Full Changelog: nodejs/undici@v6.15.0...v6.16.0

`v6.15.0`

Compare Source

What's Changed

Expose EnvHttpProxyAgent to Node.js core bundle, so it can be turned … by @mcollina in #3148
test: add headerslist copy check by @tsctx in #3156
chore: ensure automated v6 release compared to v6 by @mweberxyz in #3149
fetch: do not leak signal listeners by @mcollina in #3158
fix: request cache mode is not the same as request mode by @tsibley in #3151
fetch: don't re-lowercase HeadersList by @tsctx in #3159
fix casing issue when cloning Headers object by @KhafraDev in #3160
build(deps): bump node from 6d0f18a to db8772d in /build by @dependabot in #3163
fix header cloning bug by @tsctx in #3162
chore: change bench naming for h2 by @metcoder95 in #3165
expose WebSocket related events in node bundle by @KhafraDev in #3167
feat: add support for if-match on retry handler by @metcoder95 in #3144
fix: correct firing order of abort events by @tsctx in #3169
create fast MessageEvent by @KhafraDev in #3170
chore: add explicitly @fastify/busboy by @Uzlopak in #3172
chore: remove sinon as dev dependency by @Uzlopak in #3171
webidl changes by @KhafraDev in #3175
preserve dictionary key name in webidl errors by @KhafraDev in #3176

New Contributors

@tsibley made their first contribution in #3151

Full Changelog: nodejs/undici@v6.14.1...v6.15.0

`v6.14.1`

Compare Source

What's Changed

fix: tweak keep-alive timeout implementation by @mweberxyz in #3145
build(deps-dev): bump borp from 0.11.0 to 0.12.0 by @dependabot in #3153
build(deps): bump node from ad255c6 to 6d0f18a in /build by @dependabot in #3154
fix(EnvHttpProxyAgent): prefer lowercase env vars by @10xLaCroixDrinker in #3152

Full Changelog: nodejs/undici@v6.14.0...v6.14.1

`v6.14.0`

Compare Source

What's Changed

bench: enable benchmarks for h2 by @metcoder95 in #3100
perf: improve performance of isomorphicEncode by @tsctx in #3101
util: remove isReadableAborted by @Uzlopak in #3104
fix(types): The second parameter of EventSource is optional by @zbinlin in #3106
fix: onConnect types by @ronag in #3116
add dispatcher option to EventSource by @KhafraDev in #3119
core: improve parseURL by @Uzlopak in #3102
test: increase coverage by @Uzlopak in #3121
docs: add directions to run docs and benchmarks by @FatumaA in #3092
perf: avoid unnecessary clone by @tsctx in #3117
build(deps-dev): bump borp from 0.10.0 to 0.11.0 by @dependabot in #3126
drop node support for < v18.17.0 by @KhafraDev in #3125
test: improve test and ci performance by @Uzlopak in #3135
Added EnvHttpProxyAgent to support HTTP_PROXY by @10xLaCroixDrinker in #2994
fetch: Change wording of "Body is unusable" error by @nzakas in #3105
perf: use class instead of object literals with getters by @tsctx in #3138
fix: unhandled exception or failing error body by @ronag in #3137
reuse realm for Request/Response by @KhafraDev in #3142
fix(H2-#3140): abort requets upon GOAWAY by @metcoder95 in #3143
don't store realm on Request/Response by @KhafraDev in #3146
improve: wasm build by @Uzlopak in #3074

New Contributors

@10xLaCroixDrinker made their first contribution in #2994
@nzakas made their first contribution in #3105

Full Changelog: nodejs/undici@v6.13.0...v6.14.0

`v6.13.0`

Compare Source

What's Changed

build(deps): bump node from 9696b26 to ad255c6 in /build by @dependabot in #3073
test: remove only by @metcoder95 in #3077
fix: defer errors with setImmediate by @ronag in #3081
improve DecoratorHandler by @Uzlopak in #3079
chore: removed unused escapeFormDataName by @mcollina in #3084
Mention option to pass streams into FormData by @JaoodxD in #3086
fetch: improve performance of isValidEncodedURL by @Uzlopak in #3090
optimize utf8Decode by @Uzlopak in #3085
refactor: h2 refactoring by @metcoder95 in #3082
Skip the creation of a transform stream in fetch by @mcollina in #3093
fetch: improve performance of urlHasHttpsScheme by @Uzlopak in #3094
fetch: avoid creation of an intermediary ReadableStream by @KhafraDev in #3095
test: duplicate jest unspecific tests to native runner by @Uzlopak in #3075
build(deps): bump node from ad255c6 to 6d0f18a in /build by @dependabot in #3096
fetch: improve performance of isValidHeaderValue by @Uzlopak in #3098
chore: automate releases with pr by @mweberxyz in #3089

New Contributors

@github-actions made their first contribution in #3099

Full Changelog: nodejs/undici@v6.12.0...v6.13.0

`v6.12.0`

Compare Source

What's Changed

fix: broken test by @tsctx in #3045
fix: http2 header parsing by @climba03003 in #3047
types: fix Request.refererPolicy and RequestInit.refererPolicy are incompatible by @zbinlin in #3039
fix(types): onHeaders always takes headers as an array of buffer by @ronag in #3050
fix: ProxyAgent causes request.headers.host to be forcibly reset by @1zilc in [#3026](https://redirect.github.com/node

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

package.json

      "bitflag-js": "1.1.0",
      "undici@<5.8.0": ">=5.8.0",
-      "undici@<=5.8.1": ">=5.8.2",
+      "undici@<=5.8.1": ">=6.23.0",


renovate bot requested a review from Dougley as a code owner September 28, 2025 17:27

renovate bot added the dependencies label Sep 28, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from faafe6b to 9a460a4 Compare October 5, 2025 21:34

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Oct 5, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch 2 times, most recently from 3b5ce44 to 7aeaeaa Compare October 6, 2025 04:48

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Oct 6, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 7aeaeaa to 136350b Compare October 9, 2025 13:13

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Oct 9, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 136350b to dd5392b Compare October 9, 2025 17:48

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Oct 9, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from dd5392b to 5b58013 Compare October 21, 2025 01:55

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Oct 21, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 5b58013 to 6b436da Compare October 21, 2025 05:12

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Oct 21, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 6b436da to 1aa5282 Compare October 22, 2025 12:04

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Oct 22, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 1aa5282 to 85202b0 Compare October 22, 2025 19:40

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Oct 22, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 85202b0 to af643f0 Compare November 1, 2025 12:45

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Nov 1, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from af643f0 to 8cc5a63 Compare November 1, 2025 17:12

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Nov 1, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 8cc5a63 to 5d12d24 Compare November 10, 2025 20:37

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Nov 10, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 5d12d24 to c1dfeda Compare November 11, 2025 04:54

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Nov 11, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from c1dfeda to 212d8b5 Compare November 18, 2025 19:56

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Nov 18, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 212d8b5 to 5ad8cad Compare November 19, 2025 02:03

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Dec 31, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from ecc6a00 to a40a46a Compare December 31, 2025 20:58

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Dec 31, 2025

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from a40a46a to 101e6b4 Compare January 5, 2026 15:27

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Jan 5, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 101e6b4 to c2bcd06 Compare January 5, 2026 17:41

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Jan 5, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from c2bcd06 to 7994a34 Compare January 5, 2026 18:04

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Jan 5, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 7994a34 to 22a81ff Compare January 5, 2026 21:05

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Jan 5, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 22a81ff to da63829 Compare January 8, 2026 16:42

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Jan 8, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from da63829 to 18729af Compare January 8, 2026 21:51

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Jan 8, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch 2 times, most recently from dd8b39e to f51698f Compare January 19, 2026 16:03

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Jan 19, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from f51698f to f2a4f9a Compare January 19, 2026 17:41

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Jan 19, 2026

sentry bot reviewed Jan 19, 2026

View reviewed changes

package.json

"bitflag-js": "1.1.0",

"undici@<5.8.0": ">=5.8.0",

"undici@<=5.8.1": ">=5.8.2",

"undici@<=5.8.1": ">=6.23.0",

This comment was marked as outdated.

Sign in to view

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from f2a4f9a to 343dcca Compare January 23, 2026 19:44

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Jan 23, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 343dcca to 6d9d592 Compare January 23, 2026 22:52

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Jan 23, 2026

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from 6d9d592 to d2610eb Compare February 2, 2026 18:16

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to v6 [security]~~ chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security] Feb 2, 2026

chore(deps): update dependency undici@<=5.8.1 to v6 [security]

9cdedeb

renovate bot force-pushed the renovate/npm-undici<=5.8.1-vulnerability branch from d2610eb to 9cdedeb Compare February 2, 2026 23:02

renovate bot changed the title ~~chore(deps): update dependency undici@<=5.8.1 to >=5.29.0 [security]~~ chore(deps): update dependency undici@<=5.8.1 to v6 [security] Feb 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency undici@<=5.8.1 to v6 [security] #128

chore(deps): update dependency undici@<=5.8.1 to v6 [security] #128

renovate bot commented Sep 28, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

chore(deps): update dependency undici@&lt;&#x3d;5.8.1 to v6 [security] #128

Are you sure you want to change the base?

chore(deps): update dependency undici@&lt;&#x3d;5.8.1 to v6 [security] #128

Conversation

renovate bot commented Sep 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

For more information

Impact

Patches

Workarounds

References

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

References

Credits

Impact

Patches

Workarounds

References

Credits

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

Release Notes

What's Changed

What's Changed

What's Changed

New Contributors

⚠️ Security Release ⚠️

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

chore(deps): update dependency undici@<=5.8.1 to v6 [security] #128

chore(deps): update dependency undici@<=5.8.1 to v6 [security] #128

renovate bot commented Sep 28, 2025 •

edited

Loading