undici

What's Changed

• complete upgrade diagnostics lifecycle

• decompress: join a repeated content-encoding header

• cookies: keep a cookie named proto in getCookies

• selectively re-enable SIMD for ppc64

• use private fields for brand checks

• h2: do not unref a session with open streams

• h2: avoid pool fan-out during ALPN negotiation

• fix issue #5715

• env-http-proxy-agent: NO_PROXY wildcard semantics

• h2: do not replay a request whose response already started after GOAWAY

• proxy-agent: preserve repeated iterable headers

• dataurl parsing improvements + update WPT

• decompress: treat inherited Object.prototype names as unsupported encodings

• preserve HTTP/2 for non-upgrade legacy requests

• skip drain dispatch for clientTtl-evicted clients in PoolBase

• deduplicate: settle requests when composed with retry

• cache: do not report aborted on successful cache hits

• cookies: keep an Expires of 0 when serializing a cookie

• honor backpressure in decompression interceptor

• h2: validate h2Options.maxConcurrentStreams itself

• h2: keep the session ref'd while requests are queued

• fix cache.addAll and cache.add hanging

• retry: settle responses after connection close

• h2: validate response content-length

• redirect: ignore informational responses in history

• websocket: reset the compressed flag when a message completes

• h2: keep queued requests alive when the last stream closes

Security fixes

High severity

• security

  GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.

• security

  GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

• security

  GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.

• security

  GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.

• security

  GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.

• security

  GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.

• security

  GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

• security

  GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.

• security

  GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.

• security

  GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

• [v7.x] drop: remove Node.js 26 from shared-builtin CI build

• h2: honour headersTimeout

• h2: keep the connection ref'd while requests are outstanding

• h2: retire the request that completed, not the head of the queue

• h2: settle a request whose stream is cancelled

• reduce EventSourceStream parser allocations

• h2: handle GOAWAY for CONNECT streams

• [v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate

Security fixes

High severity

• security

  GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• security

  GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• security

  GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• reduce EventSourceStream parser allocations

• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate

Security fixes

High severity

• security

  GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.

• security

  GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.

• security

  GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

• security

  GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.

• security

  GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.

• security

  GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.

• security

  GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.

• security

  GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

• security

  GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.

• security

  GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.

• security

  GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

• retry: reject invalid resumed responses

• avoid unbounded recursion in Set-Cookie attribute parser

• honor SOCKS5 connection timeout

• eventsource: validate Last-Event-ID on reconnect

• avoid duplicate release attempts

• cache: refetch when 304 adds vary fields

• types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace

• proxy-agent: guard Proxy-Authorization in iterable header containers

• websocket: fail the connection on a non-200 h2 extended CONNECT response

• retry: forward rawHeaders writes through RetryController

• fetch: only send Sec-Fetch-Mode to potentially trustworthy URLs

What's Changed

• mock: re-invoke reply callback for persistent mocks

• preserve MockAgent interceptors for legacy global fetch

• propagate dispatcher origin to composed interceptors

• limit EventSource event size

• retry: honor the retryAfter option in the default retry strategy

• interceptor/dump: reject aborted requests when response is smaller than maxSize

• test: skip cache-tests when submodule is missing

• retry: honor the abort signal during the retry backoff

• deduplicate: settle the deduplicated request when it is aborted

• accept a negative Set-Cookie Max-Age attribute

• h2: honour maxResponseSize

• forward onBodySent/onRequestSent through interceptor handlers

• h1: drop idle-socket timer floor with a ref'd setImmediate

• fetch: skip empty RequestInit work

• propagate dispatcher options to base class

• env-http-proxy-agent: ignore trailing dots when matching no_proxy

• socks5-proxy-agent: destroy socket when negotiation times out

• cache: evict entries when a key holds a single entry

• h2: forward 1xx informational responses to onInfo

• agent: preserve pools with pending GOAWAY replays

What's Changed

• namespace h2 options

• websocket: support process.unref

• h2: ensure every request settles

• readable: consume a body whose end has already been emitted

• retry: skip the content-length checkpoint for HEAD and for a 206 without content-range

• revert idle socket validation to setTimeout(0) to prevent stall on idle event loop

• env-http-proxy-agent: match bare IPv6 addresses in no_proxy

• readable: keep body bytes that arrive after setEncoding()

• socks5: evict unused origin pools

• skip deduplication for upgrade requests

• retry: forward informational responses

• mock: non-string path matchers under ignoreTrailingSlash, and DataView reply bodies

• interceptors: cache() and deduplicate() silently inert on Client/Pool without opts.origin

• mock: emit request body lifecycle hooks

• h2: detach upgrade close handler after GOAWAY

• retry refused HTTP/2 streams

• preserve DNS origin hostname on sockets

Security fixes

• security

  GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

• security

  GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

• security

  GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Security fixes

High severity

• security

  GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• security

  GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

• security

  GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

• security

  GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

• security

  GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Security fixes

High severity

• security

  GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• security

  GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.

• security

  GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.

• security

  GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.

• security

  GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• decompress: preserve response trailers

• validate coerced header values for CRLF

• handle frozen globalThis in setGlobalDispatcher

• Ignore auto-generated .npmrc on Windows