Update dependency undici to v7.18.2 [SECURITY]

[gardener-ci-robot]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	7.15.0 → 7.18.2

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

• https://hackerone.com/reports/3456148
• GHSA-gm62-xv2j-4w53
• https://curl.se/docs/CVE-2022-32206.html

---

Release Notes

nodejs/undici (undici)

v7.18.2

Compare Source

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in #​4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

Compare Source

What's Changed

• Test and Fix running without SSL by @​mcollina in #​4727
• docs: add security warning for strictContentLength option by @​mcollina in #​4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @​dependabot[bot] in #​4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

Compare Source

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in #​4523
• ci: remove h2 by @​Uzlopak in #​4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in #​4535
• ci: fix nightly shared library case by @​Uzlopak in #​4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in #​4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in #​4393
• test: remove node20 version check by @​Uzlopak in #​4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in #​4546
• ci: set write permissions on job level by @​Uzlopak in #​4537
• lint: activate n/no-process-exit by @​Uzlopak in #​4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in #​4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in #​4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in #​4541
• test: fix plans by @​Uzlopak in #​4550
• feat: add runtime feature "detection" by @​Uzlopak in #​4545
• perf: use less promises in extractBody by @​Uzlopak in #​4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in #​4553
• fix: remove redundant line in retry-handler by @​Uzlopak in #​4554
• ci: add no-wasm-simd option by @​Uzlopak in #​4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in #​4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in #​4556
• http2: refactor and split tests of http2.js into multiple files by @​Uzlopak in #​4561
• fix: dns-interceptor test should await plan to complete by @​Uzlopak in #​4560
• chore: remove istanbul instructions by @​Uzlopak in #​4559
• fix: keep promise chains intact by @​Uzlopak in #​4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @​dependabot[bot] in #​4567
• chore: remove tspl from eventsource by @​Uzlopak in #​4569
• chore: remove tspl from fetch by @​Uzlopak in #​4570
• feat: add getUpstream() method to BalancedPool by @​mcollina in #​4586
• fetch: handle invalid priority values properly by @​Uzlopak in #​4522
• ci: fix test coverage for codecov by @​Uzlopak in #​4520
• types: optional status in Response.redirect by @​gineika in #​4591
• docs: unix socket add-on by @​FelixVaughan in #​4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in #​4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @​dependabot[bot] in #​4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @​dependabot[bot] in #​4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in #​4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @​dependabot[bot] in #​4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​4597
• fix: cacheStores types and usage in README by @​lucalooz in #​4605
• Feat dns interceptor storage by @​SuperOleg39 in #​4589
• docs: add crawling best practices by @​Uzlopak in #​4590
• fix: 304 not modified reply upon revalidation did not update cache. by @​daan944 in #​4617
• chore: use testcontext for test:infra by @​Uzlopak in #​4579
• fetch: improve regexes in data-uri.js by @​Uzlopak in #​4483
• perf: optimize validate http token by @​PandaWorker in #​4608
• test: improve long-lived-abort-controller test by @​Uzlopak in #​4621
• ci: add node.js 25 to test matrix by @​shivarm in #​4626
• chore: use testcontext for test/utils tests by @​Uzlopak in #​4577
• chore: remove tspl from websocket by @​Uzlopak in #​4568
• fix(ws) onSocketClose being called multiple times by @​KhafraDev in #​4632
• fix: prevent duplicate debug logs when multiple undici instances exist by @​mcollina in #​4630
• chore: use testcontext for busboy tests by @​Uzlopak in #​4572
• test: fix flaky http2-dispatcher test by @​mcollina in #​4633
• build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @​dependabot[bot] in #​4635
• Run the gc() in long-lived-abort-controller test by @​mcollina in #​4638
• Do not destroy the HTTP2 stream twice in tests by @​mcollina in #​4637
• Fix http2-dispatcher test by @​mcollina in #​4640
• fix: fetch blob with range off-by-one error by @​platypii in #​4643
• fix: ensure HTTP/2 sends Content-Length for empty POST requests by @​mcollina in #​4613
• build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @​dependabot[bot] in #​4645
• feat(#​2458): WebSocket through HTTP/2 by @​metcoder95 in #​4540
• docs(README): correct the example code for the consumption of respons… by @​tenkirin in #​4658
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @​dependabot[bot] in #​4653
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @​dependabot[bot] in #​4655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4652
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in #​4651
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​4654
• don't freeze urlList for opaque filtered responses by @​KhafraDev in #​4656
• fix fd parsing unquoted attribute values by @​KhafraDev in #​4662
• build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @​dependabot[bot] in #​4665
• feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @​SuperOleg39 in #​4659
• Feat/round robin pool by @​FelixVaughan in #​4650
• Formdata ignore epilogue preamble by @​KhafraDev in #​4672
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4682
• fix: snapshot url exclusion by @​FelixVaughan in #​4670
• feat: support h2c over unix domain sockets by @​chrros95 in #​4690
• fix(docs): remove unused TypeScript example code block by @​kerolloz in #​4701
• feat: add deduplicate interceptor for request deduplication by @​mcollina in #​4679
• chore: use testcontext for mock tests by @​Uzlopak in #​4582
• fix(test): remove hardcoded folder name in client-error-stack-trace test by @​mcollina in #​4707

New Contributors

• @​gineika made their first contribution in #​4591
• @​lucalooz made their first contribution in #​4605
• @​SuperOleg39 made their first contribution in #​4589
• @​daan944 made their first contribution in #​4617
• @​PandaWorker made their first contribution in #​4608
• @​platypii made their first contribution in #​4643
• @​tenkirin made their first contribution in #​4658
• @​kerolloz made their first contribution in #​4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

v7.16.0

Compare Source

What's Changed

• Drop npm token, use OIDC instead by @​mcollina in #​4447
• fetch: instantiate readableStream in extractBody with sync methods by @​Uzlopak in #​4350
• fix: remove async on [kClose] and [kDestroy], only return Promise by @​Uzlopak in #​4450
• fetch: make consumeBody sync by @​Uzlopak in #​4449
• perf: make client.connect() sync by @​Uzlopak in #​4455
• fetch: remove promise in exported fetch by @​Uzlopak in #​4452
• fix(#​4451): implement http2 cookie support by @​metcoder95 in #​4453
• test: cache store tests should properly be skipped by @​Uzlopak in #​4463
• test: fix IPv6 skip check for test/client.js by @​Uzlopak in #​4466
• test: remove skip check for AbortSignal.timeout, as it exists since node18 by @​Uzlopak in #​4464
• test: investigate macos failing by @​Uzlopak in #​4467
• test: remove obsolete < node v18 test case for http2 by @​Uzlopak in #​4461
• perf: avoid intermediate promise on BodyReadable.dump by @​Uzlopak in #​4459
• test: remove skip check for long-lived-abort-controller test (was flaky 10 months ago) by @​Uzlopak in #​4465
• test: remove skip checks for existance of global available Blob and File by @​Uzlopak in #​4460
• perf (fetch): use less promises for ReadableStream by @​Uzlopak in #​4457
• fix: catch synchronous errors in request callbacks by @​mcollina in #​4443
• fix: avoid instanceof MockNotMatchedError by @​Uzlopak in #​4474
• eventsource: remove promise for #reconnect method by @​Uzlopak in #​4469
• feat: make UndiciErrors reliable to instanceof by @​Uzlopak in #​4472
• chore: call super() after type checks by @​Uzlopak in #​4475
• chore: FixedQueue does not need special constructor by @​Uzlopak in #​4476
• fix: buildAndValidateMockOptions should always get an object passed and always return an object by @​Uzlopak in #​4479
• fix: remove unused ResponseStatusCodeError by @​Uzlopak in #​4473
• chore: pool and dispatcherbase dont need constructor, use no array helper functions by @​Uzlopak in #​4477
• lint: avoid unintented use of globals in code and tests, improve test for installing/overwriting globals by @​Uzlopak in #​4478
• test: fix macos flakyness by @​Uzlopak in #​4468
• fix: 'no-referrer-when-downgrade' in determineRequestsReferrer should return referrerURL by @​Uzlopak in #​4482
• fix: deflake cache-fastimers-fix.js by @​Uzlopak in #​4491
• fix: improve validation of IP addresses as trustworthy, correct ipv4 check by @​Uzlopak in #​4489
• test (pool.js): fix flakyness of clientTtl test by @​Uzlopak in #​4494
• test (eventsource): refactor tests for eventsource, speed them up by @​Uzlopak in #​4493
• fix: remove useless catch in client-h1.js by @​Uzlopak in #​4481
• test: skip flaky encoding test on macos and node20 by @​Uzlopak in #​4497
• fix: implement proper stale-while-revalidate behavior per RFC 5861 by @​mcollina in #​4492
• test (websocket): speed up test/websocket/issue-2679.js by @​Uzlopak in #​4501
• webidl: fix existing and add missing buffer source converters by @​Renegade334 in #​4503
• use real wpt test server by @​KhafraDev in #​4486
• test: another try to fix flaky macos and node 20 by @​Uzlopak in #​4490
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​4507
• build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.3 by @​dependabot[bot] in #​4509
• fix writing to websocketstream with SharedArrayBuffer/SharedArrayBuff… by @​KhafraDev in #​4504
• test: use faketimers for test/client-keep-alive, refactor a little by @​Uzlopak in #​4499
• build(deps): bump github/codeql-action from 3.29.7 to 3.30.0 by @​dependabot[bot] in #​4510
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @​dependabot[bot] in #​4508
• fix(h2): adjust :scheme on h2 requests by @​metcoder95 in #​4454
• chore: use lowercase filenames, remove unused verifyVersion.js by @​Uzlopak in #​4514
• chore: refactor workflows by @​Uzlopak in #​4513
• chore: use [] instead of new Array(0) by @​Uzlopak in #​4435
• change webidl attribute to bitwise flag by @​KhafraDev in #​4505
• chore: make also cache-tests integrated as a submodule by @​Uzlopak in #​4517
• ci: fine grained test nodejs workflow by @​Uzlopak in #​4516
• feat: Support for capping the number of origins in Agent by @​JoshMock in #​4365
• wpt: properly handle write permissions errors in wpt-runner setup by @​Uzlopak in #​4518
• fetch: process content-encoding header only if relevant by @​Uzlopak in #​4496
• websocket: always emit error event by @​KhafraDev in #​4521
• refactor: parseHttpDate by @​Uzlopak in #​4421
• fix: wpt should use master branch by @​Uzlopak in #​4524
• fix: shell command built from environment values by @​ptrgits in #​4392
• example: use metcoders https-pem for the example by @​Uzlopak in #​4436
• Disable SIMD for PPC64 architecture, add UNDICI_NO_WASM_SIMD env to facilitate testing by @​mcollina in #​4530
• fix: make error symbols non enumerable by @​Uzlopak in #​4531

New Contributors

• @​Renegade334 made their first contribution in #​4503
• @​JoshMock made their first contribution in #​4365
• @​ptrgits made their first contribution in #​4392

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gardener-ci-robot

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gardener-robot]

@grolu, @holgerkoser, @klocke-io You have pull request review open invite, please check