chore(deps): Update dependency undici@>=7.0.0 <7.28.0 to v8 #88
No reviewers
Labels
No labels
dependencies
major
security-pin
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
trails-cool/trails!88
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/undici-=7.0.0-7.28.0-8.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
7.29.0→8.10.0](https://renovatebot.com/diffs/npm/undici@>=7.0.0 <7.28.0/7.29.0/8.10.0)Release Notes
nodejs/undici (undici@>=7.0.0 <7.28.0)
v8.10.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.9.0...v8.10.0
v8.9.0Compare Source
⚠️ Security fixes
High severity
privateCache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.Medium severity
typeproperty on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generatedcontent-typeheader. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.=in qualifiedno-cacheandprivatedirectives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.Content-Lengthafter resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whoseContent-Lengthis inconsistent withContent-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.domainandunparsedvalues passed tosetCookie()could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.Additional hardening
Undici now validates non-string header values after coercion, including array elements, preventing crafted
toString()orSymbol.toPrimitiveimplementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.8.0...v8.9.0
v8.8.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.7.0...v8.8.0
v8.7.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.6.0...v8.7.0
v8.6.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.5.0...v8.6.0
v8.5.0Compare Source
⚠️ Security Release
This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.
Summary
32dbf0b3b4c287b342d49559a516f870cb105d7c5655ea435655ea436ea54ef8High severity
WebSocket DoS via fragment count bypass — CVE-2026-12151
GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix:
32dbf0b3websocket: limit the number of fragments in a message (alsoc5ed7875handle empty fragments and stream limits)A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.
new WebSocket(...)orWebSocketStreamagainst untrusted endpoints.
WebSocket DoS via cumulative fragment bypass — CVE-2026-9675
GHSA-38rv-x7px-6hhq · CWE-400, CWE-770
Fix:
b4c287b3fix(websocket): enforce max payload size across fragmentsUndici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697
GHSA-vmh5-mc38-953g · CWE-295
Fix:
42d49559fix: honor requestTls when proxy is SOCKS5The
ProxyAgentsilently discarded therequestTlsoption when configured witha SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as
ca,cert,key,rejectUnauthorized, andservername,falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.
ProxyAgent/Socks5ProxyAgentover SOCKS5 that rely onrequestTls.ProxyAgent, whererequestTlsfunctions correctly.Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734
GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0
Fix:
a516f870fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)Socks5ProxyAgentreused a single connection pool across different originswithout verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.
Socks5ProxyAgentacross multiple origins(introduced via #4385).
Moderate severity
Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678
GHSA-pr7r-676h-xcf6 · CWE-524
Fix:
cb105d7cfix(cache): trim qualified field namesThe cache interceptor mishandled responses with whitespace-padded
Cache-Controldirectives such asprivate=" authorization". In shared-cachemode this could cause authenticated data to be cached and served to other users.
Authorizationupstream and receive non-canonical qualified directives.caching authenticated responses, or add
Vary: Authorizationupstream.HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679
GHSA-p88m-4jfj-68fv · CWE-93
Fix:
5655ea43fix(cookies): preserve values and parse SameSite strictlyparseSetCookieapplied percent-decoding to cookie values, turning encodedsequences like
%0D%0Aand%00into literal bytes, contrary to RFC 6265 §5.4and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#3789.
NUL,
;, and=.Low severity
Set-Cookie SameSite attribute downgrade — CVE-2026-11525
GHSA-g8m3-5g58-fq7m · CWE-183
Fix:
5655ea43fix(cookies): preserve values and parse SameSite strictlyThe cookie parser accepted
SameSitevalues containingStrict,Lax, orNoneas substrings rather than requiring exact matches per RFC 6265. Valueslike
SameSite=NoneOfYourBusinessparsed asNone, andSameSite=StrictLaxparsed as
Lax, silently weakening cookie security policies for apps thatforward parsed attributes.
HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733
GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix:
6ea54ef8fix: guard idle socket validation to skip fresh sockets, hardened byc9fbe9d2keep idle validation on native timers (#5397) andac5394b8keep idle validation on global timers (#5407)An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.
keep-alive reuse.
keepAliveTimeout: 0on theClient or Pool.
Also in v8.5.0 (non-security)
v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #5397
and #5407, are covered under
CVE-2026-6733 above and are not repeated here.)
#5408don't rewindkPendingIdxpast in-flight requests ·#5391allow h2 POST request multiplexing ·#5406reap idle HTTP/2 sessions ·#5410preserve h2 queue on out-of-order completion#5416addbodyMixin.textStream()·#5418align EventSource with spec#5413document request header validation ·#5383absorb h2 stream timeout resets (test) ·#5420remove stale repro + lint ·#5426extend Windows CI timeout ·#5427detect available python in WPT runnerFull changelog:
v8.4.1...v8.5.0.Credits
Per-advisory credits (as recorded in each GHSA):
v8.4.1Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.4.0...v8.4.1
v8.4.0Compare Source
What's Changed
npm ciinstead ofnpm installby @aduh95 in #5315addAbortListenerutil by @aduh95 in #5317kEnumerablePropertyatomically by @aduh95 in #5332regex.execinstead ofstring.matchby @aduh95 in #5331preferH2connector option to offer h2 first in ALPN by @Antamansid in #5327New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.3.0...v8.4.0
v8.3.0Compare Source
What's Changed
SnapshotAgent: AddnormalizeBodyandnormalizeQueryby @GeoffreyBooth in #5121New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.2.0...v8.3.0
v8.2.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.1.0...v8.2.0
v8.1.0Compare Source
What's Changed
Full Changelog: https://github.com/nodejs/undici/compare/v8.0.3...v8.1.0
v8.0.3Compare Source
What's Changed
dump({ limit: Integer })default value by @samuel871211 in #4981dump.maxSizeby @samuel871211 in #4982New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v8.0.2...v8.0.3
v8.0.2Compare Source
What's Changed
Full Changelog: https://github.com/nodejs/undici/compare/v8.0.1...v8.0.2
v8.0.1Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/nodejs/undici/compare/v7.24.7...v8.0.1
v8.0.0Compare Source
What's Changed
Full Changelog: https://github.com/nodejs/undici/compare/v7.24.7...v8.0.0
Configuration
📅 Schedule: (in timezone Europe/Copenhagen)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
63b88a001f303a440327