Description
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 6.23.0 – < 6.29.1, 7.18.0 – < 7.30.1, 8.0.0 – < 8.12.2 | 6.29.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.12.2+dfsg+~cs3.2.3-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.21.0-1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.19.0-1.24.21.0.1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.11.1-0.4.hum1 | RHSA-2026:84657 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.20.0-1.26.11.1.0.4.hum1 | RHSA-2026:84657 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 13.6.233.17-1.24.21.0.1.5.hum1 | RHSA-2026:84706 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.11.1.0.4.hum1 | RHSA-2026:84657 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.22.1-3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.1-1.24.22.1.3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:96234 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.23.4-1.el10_2 | RLSA-2026:96094 |
| Rocky Linux 10 | nodejs24 | 1:24.22.1-3.el10_2 | RLSA-2026:96088 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:98522, RLSA-2026:96234 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:96226 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:98102 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:98113, RLSA-2026:98102 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.4-1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.4.1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.1-1.amzn2023.0.1 | ALAS2023-2026-3330 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.1.1.amzn2023.0.1 | ALAS2023-2026-3330 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.1.amzn2023.0.1 | ALAS2023-2026-3328 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.amzn2023.0.1 | ALAS2023-2026-3330 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | lerna | 10.1.1-r3 | — |
| Wolfi rolling | node-gyp | 13.1.0-r1 | — |
| Wolfi rolling | prism | 5.16.0-r19 | — |
| Wolfi rolling | renovate | 44.198.3-r1 | — |
| Wolfi rolling | vitess-24 | 24.0.5-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 6.23.0, < 6.29.1 | 6.29.1 | GHSA-xjj6-f33q-929c |
| npm | undici | >= 7.18.0, < 7.30.1 | 7.30.1 | GHSA-xjj6-f33q-929c |
| npm | undici | >= 8.0.0, < 8.12.2 | 8.12.2 | GHSA-xjj6-f33q-929c |
Advisories 17
- RLSA-2026:98522 Important: nodejs:26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 12, 2026
- RLSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 11, 2026
- RLSA-2026:98102 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 11, 2026
- ELSA-2026-96234 Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2026
- RLSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96094 Important: nodejs22 security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96094 Important: nodejs22 security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96094 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ALAS2023-2026-3330 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3328 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:84706 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:84657 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026