Skip to content

chore(deps): update dependency undici@<6.23.0 to v7 [security]#792

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-undici<6.23.0-vulnerability
Open

chore(deps): update dependency undici@&lt;6.23.0 to v7 [security]#792
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-undici<6.23.0-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 9, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
undici@<6.23.0 (source) >=6.23.0>=7.22.0 age confidence

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References


Release Notes

nodejs/undici (undici@<6.23.0)

v7.22.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

v7.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

v7.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

v7.19.2

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.19.1...v7.19.2

v7.19.1

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.19.0...v7.19.1

v7.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.18.2...v7.19.0

v7.18.2

Compare Source

What's Changed

  • fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in #​4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

v7.16.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

v7.15.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.14.0...v7.15.0

v7.14.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.13.0...v7.14.0

v7.13.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.12.0...v7.13.0

v7.12.0

Compare Source

What's Changed


Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from kongponents-bot as a code owner February 9, 2026 08:27
@renovate renovate bot force-pushed the renovate/npm-undici<6.23.0-vulnerability branch 5 times, most recently from c61efd8 to cc5370b Compare February 12, 2026 20:30
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/npm-undici<6.23.0-vulnerability branch from cc5370b to 547e844 Compare February 16, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants