Undici is an HTTP/1.1 client written from scratch for Node.js. It is useful for making HTTP requests, and it also provides APIs like fetch, request, streaming helpers, and connection pooling configuration.
Project status
- Actively maintained: The upstream push is today (2026-09-10), and there have been multiple updates in late August and early September 2026, including several security-focused updates.
- Apparent update cadence: Recent updates cluster tightly, with versions landing on roughly weekly intervals (for example, v8.10.0 on 2026-08-03, v8.10.1 on 2026-08-31, and v8.10.2 plus v6.28.1 and v7.29.1 on 2026-09-04).
AI summary generated
Recent updates
v7.29.1
v7.29.1 is primarily a security release, listing multiple GHSA advisories across WebSocket, caching, decompression, and HTTP retry behaviors, plus several HTTP/2 fixes and a small benchmarking/performance tweak. The release notes also include a number of CI and workflow maintenance changes.
Securityv6.28.1
v6.28.1 release notes describe three security fixes (WebSocket handshake protocol error handling, decompression limit handling for permessage-deflate, and retry interceptor response framing validation) plus two small performance improvements. The actual code changes include additional API surface and behavior changes (new `dns` interceptor, WebSocket option support, new Fetch body `bytes()` support) and stricter request validation and protocol handling that are not mentioned in the release notes.
BreakingSecurityFeaturesv8.10.2
Undici v8.10.2 is primarily a security release, addressing multiple high and medium severity issues across caching, decompression, retry, and WebSocket behavior. It also includes several bug fixes, plus a small number of dependency and CI/build bumps.
BreakingSecurityFeaturesv8.10.1
undici v8.10.1 primarily delivers a batch of bug fixes across mocks, retry handling, caching, proxy agent behavior, and HTTP/2 and EventSource edge cases. It also includes a couple of targeted performance tweaks around fetch and idle-socket validation. There are dependency bumps for several dev dependencies used in the build/test toolchain.
v8.10.0
undici v8.10.0 focuses on HTTP/2 option namespacing via a new h2Options object, plus a series of targeted fixes around request settlement, retry behavior, and encoding/stream edge cases. The release also includes improvements for WebSocket unref support and proxy no_proxy handling for bare IPv6 addresses.
Featuresv6.28.0
This release (v6.28.0) adds new public API surface around interceptors (notably a new DNS interceptor) and WebSocket configuration, along with several internal changes to timers, request header handling, and HTTP/1 and HTTP/2 client behavior. Release notes provided here contain only a compare link and do not enumerate changes, so the code diff is the primary source for what actually shipped.
Featuresv7.29.0
Release v7.29.0 has essentially no release-note content beyond a link to the full changelog. The actual diff shows substantive internal HTTP parser changes (llhttp), plus notable API documentation changes around `Agent` options.
BreakingFeaturesv8.9.0
undici v8.9.0 includes a small set of targeted fixes around HTTP decompression behavior, header validation, global dispatcher initialization, and a Windows-specific workaround. The release notes also include a dependency bump for ws. However, the provided diff indicates a much larger change set overall, with substantial documentation rework that is not covered by the release notes.
Breakingv8.8.0
undici v8.8.0 includes a mix of HTTP client fixes, MockAgent improvements, and cache correctness changes. Notable items include switching fetch body cloning to use ReadableStreamTee, adding support for asynchronous MockAgent reply options callbacks, and multiple robustness fixes in the HTTP/2 dispatcher. Release notes also include several documentation clarifications and CI updates (including Node.js v26).
Featuresv8.7.0
undici v8.7.0 focuses on HTTP/2 robustness and proxy behavior fixes, alongside several correctness fixes (Range, cookies, EventSource credential handling). It also includes a TypeScript type definition enhancement for RedirectHandler and multiple test/docs improvements.
Featuresv8.6.0
v8.6.0 focuses on correctness fixes across fetch, HTTP/1 and HTTP/2 handling, and proxy CONNECT behavior, plus one functional addition: support for the HTTP QUERY method (RFC 10008). The release notes also include multiple documentation updates, including a migration to doc-kit and expanded API reference pages.
Featuresv6.27.0
v6.27.0 includes targeted fixes for idle socket validation and a backport of WebSocket maxPayloadSize behavior. The code diff shows additional functional and security-related changes beyond the two brief release notes, including stricter request header validation and changes to HTTP fetch decoding and streaming error handling.
BreakingSecurityFeaturesv7.28.0
v7.28.0 release notes list a small set of bug fixes related to timer validation, SOCKS5 proxy TLS option handling, and a backport for WebSocket maxPayloadSize. However, the provided diff shows additional substantial internal HTTP parsing changes (via llhttp) and API documentation changes for Agent options and stats that are not mentioned in the release notes.
v8.5.0
undici v8.5.0 adds a couple of API/documentation improvements, and includes multiple HTTP/2 related bug fixes focused on stream multiplexing, session cleanup, and idle timer validation. Release notes also mention EventSource spec alignment and a new body stream helper (bodymixin.textStream()).
Featuresv8.4.1
v8.4.1 is a maintenance release focused on correctness fixes in the HTTP/2 client, DNS interceptor behavior, and resilience against a paused parser crash. It also includes test improvements and documentation updates (including a new Getting Started guide).
v8.4.0
v8.4.0 includes a collection of fixes and test stabilizations, plus two user-facing option additions: a redirect option to strip headers on redirect, and a connect option (preferH2) to influence ALPN negotiation. The release notes mostly focus on HTTP/2 behavior and reliability, but the code diff shows additional API and default-behavior changes that are not called out.
Featuresv7.27.2
v7.27.2 contains a targeted fix related to how undici selects the global dispatcher in Node.js v7. The code now routes global dispatcher resolution through a legacy (v1) dispatcher symbol.
v7.27.1
v7.27.1 adds support for preserving raw HTTP headers (and trailers) when bridging dispatch handlers, ensuring Node.js global fetch behavior matches expectations when using an undici Agent dispatcher. The change also extends the Dispatcher controller typing to expose these raw values to handler callbacks.
v7.27.0
v7.27.0 includes a fix intended to make Undici work with Node.js 26, specifically around how Node’s global fetch interacts with Undici’s global dispatcher. The documented change focuses on supporting the legacy global dispatcher behavior.
v6.26.0
Release v6.26.0 documents a fix for validating EOF for chunked HTTP/1 (h1) responses. The actual code diff shows additional, substantial behavioral changes in HTTP response decoding (Content-Encoding handling), request header validation, dispatcher timeout mechanics, HTTP/2 GOAWAY handling, and new WebSocket and DNS related APIs.
SecurityFeatures