Packages / undici / Security

ModerateVulnerabilityGHSA-g9mf-h72j-4rw9Published 14 Jan 2026

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Affected · undici

  • >= 7.0.0, < 7.18.2
  • < 6.23.0

Fixed in

7.18.2

npm install undici@7.18.2

  1. Affected

    0.1.0 – 6.22.0

    199 releases

  2. Fixed

    6.23.0 – 6.29.1

    10 releases

  3. Affected

    7.0.0 – 7.18.1

    24 releases

  4. Fixed

    7.18.2 – 8.12.3

    51 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.