Undici npm Package: Five Vulnerabilities Disclosed Together Affecting HTTP Client Functions
A batch of five vulnerabilities in the npm package Undici, disclosed on July 30, 2026, impacts cookie handling, request validation, caching, and retry mechanisms.
Key findings
- Five vulnerabilities disclosed in Undici on July 30, 2026, affecting multiple release lines.
- Issues include improper sanitization of cookie attributes and request body validation.
- Cache interceptor mishandles whitespace and malformed directives, potentially serving incorrect cached content.
- Retry mechanism can lead to discrepancies between body length and Content-Length header.
- Vulnerabilities impact Undici versions prior to 6.28.0, 7.0.0-7.28.0, and 8.0.0-8.8.0.
On July 30, 2026, a batch of five vulnerabilities was disclosed in the npm package Undici, a popular HTTP/1.1 client for Node.js. These vulnerabilities, all disclosed on the same day, highlight issues within Undici's handling of cookie attributes, request bodies, cache directives, and response retries. The affected versions span multiple release lines, indicating a need for widespread updates across applications utilizing this library.
Several of the disclosed vulnerabilities stem from improper sanitization and validation within Undici's core functionalities. CVE-2026-16729 addresses a flaw in the setCookie function where cookie attributes were not fully sanitized, potentially allowing for injection attacks. Similarly, CVE-2026-15157 points to a vulnerability where the type property of a duck-typed blob-like request body was not validated, leading to incorrect Content-Type headers being set.
The cache interceptor in Undici was also found to be susceptible to mishandling. CVE-2026-14643 details how optional whitespace around the equals sign in Cache-Control directives was not properly managed, leading to either the directive being dropped or incorrect field names being stored. A related issue, CVE-2026-13697, concerns the mishandling of malformed Cache-Control private directives, which could result in unintended responses being served from the cache.
Another critical area affected is Undici's retry mechanism. CVE-2026-16728 describes how the retry interceptor could lead to a situation where the response body length does not match the Content-Length header, especially after a retry or resume of a partial response. This discrepancy could be exploited by malicious or faulty upstream servers.
The vulnerabilities impact multiple versions of Undici, specifically affecting versions before 6.28.0, versions from 7.0.0 up to before 7.29.0, and versions from 8.0.0 up to before 8.9.0. This wide range of affected versions underscores the importance for developers to check their Undici dependencies and apply the necessary patches. The disclosure of these issues together suggests a coordinated effort to address a cluster of related bugs within the library.
Users of Undici are advised to update to patched versions as soon as possible to mitigate the risks associated with these vulnerabilities. The broad impact across different release lines necessitates a thorough review of all applications relying on Undici for their HTTP communication needs. Staying updated with security advisories for npm packages is crucial for maintaining a secure Node.js ecosystem.