Releases of undici
284 stable releases, newest first. Release notes are kept for the last 90 days; older ones link to where they were published.
8.12.3
19 October 2026What's Changed
h2: replace a connection that stops responding after a stream timeout
pool: keep caller async context for queued requests
8.12.2
15 October 2026Security fixes
High severity
Denial of service via TLS 1.2 certificate-changing renegotiation
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
8.12.1
14 October 2026What's Changed
restore build:wasm npm script
8.12.0
14 October 2026What's Changed
cookies: ignore a numeric expires outside the Date range
http2: pause bodyTimeout while applying backpressure
cache: track cached response abort state
8.11.2
24 September 2026What's Changed
close rejected HTTP/2 WebSocket handshake streams
avoid reconnecting aborted requests
8.11.1
24 September 2026What's Changed
deslopify websocket test
Revert "fix: preserve HTTP/2 for legacy fetch consumers"
fix websocketstream bugs
8.11.0
22 September 2026What's Changed
complete upgrade diagnostics lifecycle
decompress: join a repeated content-encoding header
cookies: keep a cookie named proto in getCookies
8.10.2
4 September 2026Security fixes
High severity
- security
GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
- security
GHSA-w293-vg96-wgc3:
BalancedPoolcould drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preservesconnectand legacytlsoptions when creating upstreams. Fixed by 8f5868fb.
- security
8.10.1
31 August 2026What's Changed
mock: re-invoke reply callback for persistent mocks
preserve MockAgent interceptors for legacy global fetch
propagate dispatcher origin to composed interceptors
8.10.0
3 August 2026What's Changed
namespace h2 options
websocket: support process.unref
h2: ensure every request settles
8.9.0
24 July 2026Security fixes
High severity
- security
GHSA-4cwx-7wf7-3272: malformed qualified
privateCache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.
Medium severity
- security
8.8.0
20 July 20268.7.0
4 July 20268.6.0
2 July 20268.5.0
15 June 20268.4.1
8 June 20268.4.0
6 June 20268.3.0
14 May 20268.2.0
1 May 20268.1.0
13 April 20268.0.3
12 April 20268.0.2
4 April 20268.0.1
3 April 20268.0.0
2 April 20267.30.1
15 October 2026Security fixes
High severity
Denial of service via TLS 1.2 certificate-changing renegotiation
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
7.30.0
25 September 2026What's Changed
[Backport v7.x] fix: selectively re-enable SIMD for ppc64
Backport upgrade diagnostics lifecycle fixes to v7.x
[Backport v7.x] fix: honor backpressure in decompression interceptor
7.29.1
4 September 2026Security fixes
High severity
- security
GHSA-w293-vg96-wgc3:
BalancedPoolcould drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preservesconnectand legacytlsoptions when creating upstreams. Fixed by f690157d. - security
GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught
TypeErrorthat could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.
- security
7.29.0
24 July 2026Security fixes
High severity
- security
GHSA-4cwx-7wf7-3272: malformed qualified
privateCache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.
Medium severity
- security
7.28.0
15 June 20267.27.2
6 June 20267.27.1
4 June 20267.27.0
1 June 20267.26.0
25 May 20267.25.0
13 April 20267.24.8
12 April 20267.24.7
1 April 20267.24.6
25 March 20267.24.5
19 March 20267.24.4
16 March 20267.24.3
14 March 20267.24.2
14 March 20267.24.1
13 March 20267.24.0
12 March 20267.23.0
12 March 20267.22.0
13 February 20267.21.0
6 February 20267.20.0
1 February 20267.19.2
27 January 20267.19.1
24 January 20267.19.0
21 January 2026