Packages / undici / Security

HighVulnerabilityGHSA-4cwx-7wf7-3272Published 3 Aug 2026

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Affected · undici

  • >= 7.0.0, < 7.29.0
  • >= 8.0.0, < 8.9.0

Fixed in

8.9.0

npm install undici@8.9.0

  1. Not affected

    0.1.0 – 6.29.1

    209 releases

  2. Affected

    7.0.0 – 7.28.0

    47 releases

  3. Fixed

    7.29.0 – 7.30.1

    4 releases

  4. Affected

    8.0.0 – 8.8.0

    13 releases

  5. Fixed

    8.9.0 – 8.12.3

    11 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.