Packages / undici / Security

HighVulnerabilityGHSA-vp8m-p9jh-q5pmPublished 29 Sept 2026

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Affected · undici

  • >= 8.10.0, < 8.10.2

Fixed in

8.10.2

npm install undici@8.10.2

  1. Not affected

    0.1.0 – 8.9.0

    274 releases

  2. Affected

    8.10.0 – 8.10.1

    2 releases

  3. Fixed

    8.10.2 – 8.12.3

    8 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.