CompatHub
Check EOL

Package compatibility

Undici 5.0

What Node.js versions does this Undici version support?

Compatibility is derived from the declared Node.js version requirement (npm engines.node). CompatHub does not independently test every combination.

Declared Node.js requirement

engines.node
>=12.18
Tip version
5.21.2
Source
npm Registry (engines.node)

Node.js compatibility matrix

Evaluated against CompatHub Node.js VersionLines. Compatibility and lifecycle status are separate signals.

Other Undici lines

Security

Advisories affecting Undici 5.0 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
15
Known exploited
0
Highest CVSS
—
  • CVE-2026-15157GHSA-m8rv-5g2x-5cg5

    undici vulnerable to CRLF Injection via blob-like body 'type' property

    Affected:
    <6.28.0
    Fixed in:
    6.28.0
    Source:
    OSV source · Advisory
  • CVE-2026-16729GHSA-v3r7-h72x-cjcm

    undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

    Affected:
    <6.28.0
    Fixed in:
    6.28.0
    Source:
    OSV source · Advisory
  • CVE-2026-16728GHSA-8xcm-r25x-g524

    undici vulnerable to downstream response desynchronization via retry interceptor

    Affected:
    <6.28.0
    Fixed in:
    6.28.0
    Source:
    OSV source · Advisory
  • CVE-2026-11525GHSA-g8m3-5g58-fq7m

    undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

    Affected:
    <6.27.0
    Fixed in:
    6.27.0
    Source:
    OSV source · Advisory
  • CVE-2026-12151GHSA-vxpw-j846-p89q

    undici WebSocket client vulnerable to denial of service via fragment count bypass

    Affected:
    <6.27.0
    Fixed in:
    6.27.0
    Source:
    OSV source · Advisory
  • CVE-2026-9679GHSA-p88m-4jfj-68fv

    undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

    Affected:
    <6.27.0
    Fixed in:
    6.27.0
    Source:
    OSV source · Advisory
  • CVE-2026-6733GHSA-35p6-xmwp-9g52

    undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

    Affected:
    <6.27.0
    Fixed in:
    6.27.0
    Source:
    OSV source · Advisory
  • CVE-2026-1526GHSA-vrm6-8vpv-qv8q

    Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

    Affected:
    <6.24.0
    Fixed in:
    6.24.0
    Source:
    OSV source · Advisory
  • CVE-2026-2229GHSA-v9p9-hfj2-hcw8

    Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

    Affected:
    <6.24.0
    Fixed in:
    6.24.0
    Source:
    OSV source · Advisory
  • CVE-2026-1527GHSA-4992-7rv2-5pvq

    Undici has CRLF Injection in undici via `upgrade` option

    Affected:
    <6.24.0
    Fixed in:
    6.24.0
    Source:
    OSV source · Advisory
  • CVE-2026-1525GHSA-2mjp-6q6p-2qxm

    Undici has an HTTP Request/Response Smuggling issue

    Affected:
    <6.24.0
    Fixed in:
    6.24.0
    Source:
    OSV source · Advisory
  • CVE-2026-22036GHSA-g9mf-h72j-4rw9

    Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

    Affected:
    <6.23.0
    Fixed in:
    6.23.0
    Source:
    OSV source · Advisory
  • CVE-2025-47279GHSA-cxrh-j4jr-qwg3

    undici Denial of Service attack via bad certificate data

    Affected:
    <5.29.0
    Fixed in:
    5.29.0
    Source:
    OSV source · Advisory
  • CVE-2024-30261GHSA-9qxr-qj54-h672

    Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

    Affected:
    <5.28.4
    Fixed in:
    5.28.4
    Source:
    OSV source · Advisory
  • CVE-2024-30260GHSA-m4v8-wqvr-p9f7

    Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

    Affected:
    <5.28.4
    Fixed in:
    5.28.4
    Source:
    OSV source · Advisory