chore(deps): update dependency undici to v7.18.2 [security] - autoclosed by renovate[bot] · Pull Request #105 · shahradelahi/node-vault

renovate · 2026-01-19T18:41:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`7.12.0` → `7.18.2`

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

CVE-2026-22036 / GHSA-g9mf-h72j-4rw9

More information

Details

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici)

`v7.18.2`

Compare Source

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

`v7.18.1`

Compare Source

What's Changed

Test and Fix running without SSL by @mcollina in #4727
docs: add security warning for strictContentLength option by @mcollina in #4726
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

What's Changed

chore: extract infra and encoding methods by @Uzlopak in #4523
ci: remove h2 by @Uzlopak in #4534
ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
ci: fix nightly shared library case by @Uzlopak in #4543
test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
docs: add Cache Interceptor example to README by @tawseefnabi in #4393
test: remove node20 version check by @Uzlopak in #4544
types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
ci: set write permissions on job level by @Uzlopak in #4537
lint: activate n/no-process-exit by @Uzlopak in #4548
ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
test: fix plans by @Uzlopak in #4550
feat: add runtime feature "detection" by @Uzlopak in #4545
perf: use less promises in extractBody by @Uzlopak in #4458
fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
fix: remove redundant line in retry-handler by @Uzlopak in #4554
ci: add no-wasm-simd option by @Uzlopak in #4533
fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
chore: remove istanbul instructions by @Uzlopak in #4559
fix: keep promise chains intact by @Uzlopak in #4558
build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
chore: remove tspl from eventsource by @Uzlopak in #4569
chore: remove tspl from fetch by @Uzlopak in #4570
feat: add getUpstream() method to BalancedPool by @mcollina in #4586
fetch: handle invalid priority values properly by @Uzlopak in #4522
ci: fix test coverage for codecov by @Uzlopak in #4520
types: optional status in Response.redirect by @gineika in #4591
docs: unix socket add-on by @FelixVaughan in #4587
build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
fix: cacheStores types and usage in README by @lucalooz in #4605
Feat dns interceptor storage by @SuperOleg39 in #4589
docs: add crawling best practices by @Uzlopak in #4590
fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
chore: use testcontext for test:infra by @Uzlopak in #4579
fetch: improve regexes in data-uri.js by @Uzlopak in #4483
perf: optimize validate http token by @PandaWorker in #4608
test: improve long-lived-abort-controller test by @Uzlopak in #4621
ci: add node.js 25 to test matrix by @shivarm in #4626
chore: use testcontext for test/utils tests by @Uzlopak in #4577
chore: remove tspl from websocket by @Uzlopak in #4568
fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
chore: use testcontext for busboy tests by @Uzlopak in #4572
test: fix flaky http2-dispatcher test by @mcollina in #4633
build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
Run the gc() in long-lived-abort-controller test by @mcollina in #4638
Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
Fix http2-dispatcher test by @mcollina in #4640
fix: fetch blob with range off-by-one error by @platypii in #4643
fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
fix fd parsing unquoted attribute values by @KhafraDev in #4662
build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
Feat/round robin pool by @FelixVaughan in #4650
Formdata ignore epilogue preamble by @KhafraDev in #4672
build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
fix: snapshot url exclusion by @FelixVaughan in #4670
feat: support h2c over unix domain sockets by @chrros95 in #4690
fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
chore: use testcontext for mock tests by @Uzlopak in #4582
fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

@gineika made their first contribution in #4591
@lucalooz made their first contribution in #4605
@SuperOleg39 made their first contribution in #4589
@daan944 made their first contribution in #4617
@PandaWorker made their first contribution in #4608
@platypii made their first contribution in #4643
@tenkirin made their first contribution in #4658
@kerolloz made their first contribution in #4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

`v7.16.0`

Compare Source

What's Changed

Drop npm token, use OIDC instead by @mcollina in #4447
fetch: instantiate readableStream in extractBody with sync methods by @Uzlopak in #4350
fix: remove async on [kClose] and [kDestroy], only return Promise by @Uzlopak in #4450
fetch: make consumeBody sync by @Uzlopak in #4449
perf: make client.connect() sync by @Uzlopak in #4455
fetch: remove promise in exported fetch by @Uzlopak in #4452
fix(#4451): implement http2 cookie support by @metcoder95 in #4453
test: cache store tests should properly be skipped by @Uzlopak in #4463
test: fix IPv6 skip check for test/client.js by @Uzlopak in #4466
test: remove skip check for AbortSignal.timeout, as it exists since node18 by @Uzlopak in #4464
test: investigate macos failing by @Uzlopak in #4467
test: remove obsolete < node v18 test case for http2 by @Uzlopak in #4461
perf: avoid intermediate promise on BodyReadable.dump by @Uzlopak in #4459
test: remove skip check for long-lived-abort-controller test (was flaky 10 months ago) by @Uzlopak in #4465
test: remove skip checks for existance of global available Blob and File by @Uzlopak in #4460
perf (fetch): use less promises for ReadableStream by @Uzlopak in #4457
fix: catch synchronous errors in request callbacks by @mcollina in #4443
fix: avoid instanceof MockNotMatchedError by @Uzlopak in #4474
eventsource: remove promise for #reconnect method by @Uzlopak in #4469
feat: make UndiciErrors reliable to instanceof by @Uzlopak in #4472
chore: call super() after type checks by @Uzlopak in #4475
chore: FixedQueue does not need special constructor by @Uzlopak in #4476
fix: buildAndValidateMockOptions should always get an object passed and always return an object by @Uzlopak in #4479
fix: remove unused ResponseStatusCodeError by @Uzlopak in #4473
chore: pool and dispatcherbase dont need constructor, use no array helper functions by @Uzlopak in #4477
lint: avoid unintented use of globals in code and tests, improve test for installing/overwriting globals by @Uzlopak in #4478
test: fix macos flakyness by @Uzlopak in #4468
fix: 'no-referrer-when-downgrade' in determineRequestsReferrer should return referrerURL by @Uzlopak in #4482
fix: deflake cache-fastimers-fix.js by @Uzlopak in #4491
fix: improve validation of IP addresses as trustworthy, correct ipv4 check by @Uzlopak in #4489
test (pool.js): fix flakyness of clientTtl test by @Uzlopak in #4494
test (eventsource): refactor tests for eventsource, speed them up by @Uzlopak in #4493
fix: remove useless catch in client-h1.js by @Uzlopak in #4481
test: skip flaky encoding test on macos and node20 by @Uzlopak in #4497
fix: implement proper stale-while-revalidate behavior per RFC 5861 by @mcollina in #4492
test (websocket): speed up test/websocket/issue-2679.js by @Uzlopak in #4501
webidl: fix existing and add missing buffer source converters by @Renegade334 in #4503
use real wpt test server by @KhafraDev in #4486
test: another try to fix flaky macos and node 20 by @Uzlopak in #4490
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4507
build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.3 by @dependabot[bot] in #4509
fix writing to websocketstream with SharedArrayBuffer/SharedArrayBuff… by @KhafraDev in #4504
test: use faketimers for test/client-keep-alive, refactor a little by @Uzlopak in #4499
build(deps): bump github/codeql-action from 3.29.7 to 3.30.0 by @dependabot[bot] in #4510
build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #4508
fix(h2): adjust :scheme on h2 requests by @metcoder95 in #4454
chore: use lowercase filenames, remove unused verifyVersion.js by @Uzlopak in #4514
chore: refactor workflows by @Uzlopak in #4513
chore: use [] instead of new Array(0) by @Uzlopak in #4435
change webidl attribute to bitwise flag by @KhafraDev in #4505
chore: make also cache-tests integrated as a submodule by @Uzlopak in #4517
ci: fine grained test nodejs workflow by @Uzlopak in #4516
feat: Support for capping the number of origins in Agent by @JoshMock in #4365
wpt: properly handle write permissions errors in wpt-runner setup by @Uzlopak in #4518
fetch: process content-encoding header only if relevant by @Uzlopak in #4496
websocket: always emit error event by @KhafraDev in #4521
refactor: parseHttpDate by @Uzlopak in #4421
fix: wpt should use master branch by @Uzlopak in #4524
fix: shell command built from environment values by @ptrgits in #4392
example: use metcoders https-pem for the example by @Uzlopak in #4436
Disable SIMD for PPC64 architecture, add UNDICI_NO_WASM_SIMD env to facilitate testing by @mcollina in #4530
fix: make error symbols non enumerable by @Uzlopak in #4531

New Contributors

@Renegade334 made their first contribution in #4503
@JoshMock made their first contribution in #4365
@ptrgits made their first contribution in #4392

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

`v7.15.0`

Compare Source

What's Changed

feat: extract sri from fetch, upgrade to latest spec by @Uzlopak in #4307
Update WPT by @github-actions[bot] in #4422
build(deps-dev): bump @fastify/busboy from 3.1.1 to 3.2.0 by @dependabot[bot] in #4428
fix: memory leak in Agent by @hexchain in #4425
chore: remove lib/api/util.js by @Uzlopak in #3578
ci: reenable shared builtin CI tests by @richardlau in #4426
Decompression Interceptor by @FelixVaughan in #4317
chore: update llhttp by @Uzlopak in #4431
chore: remove unused exceptions in try catch blocks by @Uzlopak in #4440
types: remove type Error = unknown for diagnostic-channels by @Uzlopak in #4438
chore: avoid overriding global escape and unescape by @Uzlopak in #4437
cache : serialize Query only if needed, avoid throwing error by @Uzlopak in #4441
types: add SnapshotRecorderMode by @Uzlopak in #4442

New Contributors

@hexchain made their first contribution in #4425

Full Changelog: nodejs/undici@v7.14.0...v7.15.0

`v7.14.0`

Compare Source

What's Changed

Fix flaky snapshot-testing by @mcollina in #4367
Actually flush the file in lib/mock/snapshot-recorder.js by @mcollina in #4378
docs: clarify Node.js version support in LTS table by @mcollina in #4375
cache: fix excessive caching and some other lack of caching by @fredericDelaporte in #4335
feat(websocket): add handshake response info to undici:websocket:open diagnostic event by @tawseefnabi in #4396
feat: add install() function to type definitions by @jsaguet in #4384
build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in #4380
build(deps): bump cronometro from 4.0.3 to 5.3.0 in /benchmarks by @dependabot[bot] in #4171
build(deps): bump step-security/harden-runner from 2.12.0 to 2.13.0 by @dependabot[bot] in #4379
fix: h2 CI by @metcoder95 in #4395
feat: EventSource can be configured with reconnectionTime by @Uzlopak in #4260
build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #4404
eventsource: deflake reconnectionTime tests by @Uzlopak in #4406
cache: change normaliseHeaders to normalizeHeaders by @Uzlopak in #4408
build(deps-dev): bump jest from 29.7.0 to 30.0.5 by @dependabot[bot] in #4387
build(deps-dev): bump cross-env from 7.0.3 to 10.0.0 by @dependabot[bot] in #4386
cache-control: no-cache: use quoted-string form by @alxndrsn in #4177
test: fix snapshot testing flaky test by @Uzlopak in #4410
fix formdata constructor args mark optional by @tsctx in #4411
Update WPT by @github-actions[bot] in #4358
Update Cache Tests by @github-actions[bot] in #4096
chore: improve imports and requires by @Uzlopak in #4418
refactor: snapshot-recorder by @Uzlopak in #4413
Update WPT by @github-actions[bot] in #4416
fix: better set a finalizer on cloned response by @tsctx in #4419

New Contributors

@tawseefnabi made their first contribution in #4396
@jsaguet made their first contribution in #4384

Full Changelog: nodejs/undici@v7.13.0...v7.14.0

`v7.13.0`

Compare Source

What's Changed

MockAgent.prototype.get support ignoreTrailingSlash option by @lisez in #4344
chore: more jsdoc and minor improvements for lib/api/readable.js, by @Uzlopak in #4351
ci: skip Node.js 20 tests on Windows by @mcollina in #4353
Update WPT by @github-actions[bot] in #4267
feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) by @caitp in #4340
fix: detect and prevent redirect loops with Client/Pool by @mcollina in #4361
remove node:buffer imports by @KhafraDev in #4362
fix: remove deprecated maxRedirections option from types by @mcollina in #4363
Amend the GC warning in the README to clarify that consuming bodies is recommended but not required by @mcollina in #4364
fix(inteceptor/dump): handle preemptive network errors by @metcoder95 in #4354
feat: add SnapshotAgent for HTTP request recording and playback by @mcollina in #4270

New Contributors

@lisez made their first contribution in #4344

Full Changelog: nodejs/undici@v7.12.0...v7.13.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-01-19T18:41:07Z

⚠️ No Changeset found

Latest commit: 128df72

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

chore(deps): update dependency undici to v7.18.2 [security]

128df72

renovate bot changed the title ~~chore(deps): update dependency undici to v7.18.2 [security]~~ chore(deps): update dependency undici to v7.18.2 [security] - autoclosed Jan 31, 2026

renovate bot closed this Jan 31, 2026

renovate bot deleted the renovate/npm-undici-vulnerability branch January 31, 2026 04:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

chore(deps): update dependency undici to v7.18.2 [security] - autoclosed#105

chore(deps): update dependency undici to v7.18.2 [security] - autoclosed#105
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-undici-vulnerability

renovate bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Comments

Conversation

renovate bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

changeset-bot bot commented Jan 19, 2026

⚠️ No Changeset found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 19, 2026 •

edited

Loading