Packages / undici / Security

HighVulnerabilityGHSA-f269-vfmq-vjvjPublished 13 Mar 2026

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Affected · undici

  • >= 6.0.0, < 6.24.0
  • >= 7.0.0, < 7.24.0

Fixed in

7.24.0

npm install undici@7.24.0

  1. Not affected

    0.1.0 – 5.29.0

    152 releases

  2. Affected

    6.0.0 – 6.23.0

    48 releases

  3. Fixed

    6.24.0 – 6.29.1

    9 releases

  4. Affected

    7.0.0 – 7.23.0

    32 releases

  5. Fixed

    7.24.0 – 8.12.3

    43 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.