Packages / undici / Security

ModerateVulnerabilityGHSA-3wwx-pv8p-q78vPublished 28 Sept 2026

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

Affected · undici

  • >= 6.25.0, < 6.28.1
  • >= 7.28.0, < 7.29.1
  • >= 8.1.0, < 8.10.2

Fixed in

8.10.2

npm install undici@8.10.2

  1. Not affected

    0.1.0 – 6.24.1

    202 releases

  2. Affected

    6.25.0 – 6.28.0

    4 releases

  3. Fixed

    6.28.1 – 7.27.2

    49 releases

  4. Affected

    7.28.0 – 7.29.0

    2 releases

  5. Fixed

    7.29.1 – 8.0.3

    7 releases

  6. Affected

    8.1.0 – 8.10.1

    12 releases

  7. Fixed

    8.10.2 – 8.12.3

    8 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.