Packages / undici / Security

HighVulnerabilityGHSA-vxpw-j846-p89qPublished 19 Jun 2026

undici WebSocket client vulnerable to denial of service via fragment count bypass

Affected · undici

  • < 6.27.0
  • >= 7.0.0, < 7.28.0
  • >= 8.0.0, < 8.5.0

Fixed in

8.5.0

npm install undici@8.5.0

  1. Affected

    0.1.0 – 6.26.0

    204 releases

  2. Fixed

    6.27.0 – 6.29.1

    5 releases

  3. Affected

    7.0.0 – 7.27.2

    46 releases

  4. Fixed

    7.28.0 – 7.30.1

    5 releases

  5. Affected

    8.0.0 – 8.4.1

    9 releases

  6. Fixed

    8.5.0 – 8.12.3

    15 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.