Releases of undici
284 stable releases, newest first. Release notes are kept for the last 90 days; older ones link to where they were published.
7.18.2
6 January 20267.18.1
6 January 20267.18.0
5 January 20267.17.0
5 January 20267.16.0
9 September 20257.15.0
22 August 20257.14.0
17 August 20257.13.0
31 July 20257.12.0
18 July 20257.11.0
26 June 20257.10.0
20 May 20257.9.0
10 May 20257.8.0
10 April 20257.7.0
2 April 20257.6.0
27 March 20257.5.0
12 March 20257.4.0
28 February 20257.3.0
22 January 20257.2.3
16 January 20257.2.2
15 January 20257.2.1
9 January 20257.2.0
18 December 20247.1.1
16 December 20247.1.0
3 December 20247.0.0
27 November 20246.29.1
15 October 2026Security fixes
High severity
Denial of service via TLS 1.2 certificate-changing renegotiation
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
6.29.0
25 September 2026What's Changed
[v6.x] fix(retry): settle exposed body on terminal failure
Backport upgrade diagnostics lifecycle fixes to v6.x
6.28.1
4 September 2026Security fixes
High severity
- security
GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught
TypeErrorthat could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.
Medium severity
- security
6.28.0
24 July 2026Security fixes
- security
GHSA-m8rv-5g2x-5cg5: a malicious
typeproperty on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generatedcontent-typeheader. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c. - security
GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale
Content-Lengthafter resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whoseContent-Lengthis inconsistent withContent-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6. - security
GHSA-v3r7-h72x-cjcm: unsanitized
domainandunparsedvalues passed tosetCookie()could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.
- security
6.27.0
15 June 20266.26.0
25 May 20266.25.0
14 April 20266.24.1
14 March 20266.24.0
12 March 20266.23.0
5 January 20266.22.0
3 October 20256.21.3
13 May 20256.21.2
13 March 20256.21.1
16 January 20256.21.0
13 November 20246.20.1
14 October 20246.20.0
9 October 20246.19.8
19 August 20246.19.7
9 August 20246.19.6
9 August 20246.19.5
31 July 20246.19.4
22 July 20246.19.3
22 July 20246.19.2
18 June 20246.19.1
17 June 2024