Packages / undici / Security

LowVulnerabilityGHSA-r53p-7pc4-xj5rPublished 29 Sept 2026

undici vulnerable to downstream response splitting via retry interceptor

Affected · undici

  • < 6.28.1
  • >= 7.0.0, < 7.29.1
  • >= 8.0.0, < 8.10.2

Fixed in

8.10.2

npm install undici@8.10.2

  1. Affected

    0.1.0 – 6.28.0

    206 releases

  2. Fixed

    6.28.1 – 6.29.1

    3 releases

  3. Affected

    7.0.0 – 7.29.0

    48 releases

  4. Fixed

    7.29.1 – 7.30.1

    3 releases

  5. Affected

    8.0.0 – 8.10.1

    16 releases

  6. Fixed

    8.10.2 – 8.12.3

    8 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.