Undici is an HTTP/1.1 client written from scratch for Node.js. It is useful for making HTTP requests, and it also provides APIs like fetch, request, streaming helpers, and connection pooling configuration.
Project status
- Actively maintained: The upstream GitHub source shows a very recent push (2026-10-22) and frequent recent updates across multiple major/minor version lines, including security and bug-fix work.
- Update cadence: Updates are coming in on the order of days to about a week recently (for example, 2026-10-14 through 2026-10-19), with continued activity into 2026-10-22.
AI summary generated
Recent updates
v7.30.2
Undici v7.30.2 is primarily a security release, fixing six reported vulnerabilities involving cache redirects and revalidation, credential handling, cache replay errors, and Subresource Integrity parsing. The release notes also list fixes for repeated Content-Encoding headers, HTTP/1 service errors, and extractBody, plus a CI fix. The supplied code diff has a different base version from the release notes and is truncated, so code-only changes cannot be reliably attributed to v7.30.2 without the correct comparison.
SecurityFeaturesv8.12.4
Undici v8.12.4 addresses six security vulnerabilities affecting caching, redirects, error handling, and Subresource Integrity verification. It also includes fixes for mocks, fetch, HTTP/2, cache behavior, and parser handling, along with development dependency updates.
Securityv8.12.3
v8.12.3 updates CI to use Python 3.14 for the WPT server on macOS, bumps development lint tooling (neostandard and eslint), and improves documentation for interceptors.cache() options. In runtime code, it fixes HTTP/2 behavior around stream timeouts on unresponsive connections and improves async context preservation for queued Pool requests.
v8.12.2
Release v8.12.2 is presented as a security update to undici, addressing multiple denial of service issues and TLS certificate validation bypasses, plus an SRI validation bypass. The release notes describe how undici avoids crashes and preserves TLS option behavior, and adds bounds and validation to prevent resource exhaustion and cache poisoning.
Securityv6.29.1
v6.29.1 primarily ships security fixes covering multiple denial-of-service scenarios and TLS validation issues in undici, plus a single documented fetch-related fix around aborting Streams. Despite the release notes focusing on those items, the code diff shows additional functional additions and tighter validation/behavior changes that are not mentioned in the release notes.
BreakingSecurityFeaturesv7.30.1
v7.30.1 is primarily a security release for undici, addressing multiple denial of service vectors and validation bypasses affecting fetch, TLS handling, caching, decompression, SRI, EventSource parsing, and WebSocket PONG backpressure. The release notes enumerate several CVEs and describe mitigation behavior at a feature level, but they do not mention lower-level HTTP parsing changes to the vendored llhttp dependency.
Securityv8.12.1
v8.12.1 primarily includes a build script restoration for the WASM build workflow, plus additional HTTP/2 test guards to catch unexpected disconnect behavior. The code changes are limited to package metadata, a package.json script, and updates to a single test file.
v8.12.0
v8.12.0 contains a large set of targeted bug fixes across cookies, HTTP/1 and HTTP/2 behavior, caching layers, redirects, eventsource, retry/resume flows, and various edge cases. It also introduces experimental Milo parser-related work, including a change to throw an error when WebAssembly is not available, plus several CI and documentation updates.
BreakingFeaturesv6.29.0
v6.29.0 release notes only mention a retry fix and some diagnostics lifecycle and timeout synchronization. The code diff, however, contains additional externally visible API and behavior changes including new interceptors and WebSocket/Body/Diagnostics enhancements, plus stricter request header validation logic that can cause new runtime errors.
BreakingFeaturesv7.30.0
v7.30.0 backports several fixes to undici, including updates to fetch and decompression behavior, HTTP/2 WebSocket cleanup, and diagnostics lifecycle adjustments. It also selectively re-enables wasm SIMD on ppc64 for Node versions where it is no longer known-broken.
v8.11.2
v8.11.2 contains two targeted fixes related to HTTP/2 behavior. It improves robustness around rejected HTTP/2 WebSocket handshakes and prevents aborted requests from triggering unintended reconnect behavior.
v8.11.1
undici v8.11.1 focuses on fixing WebSocket and fetch edge cases, including a hang on 3xx responses with large bodies, and multiple WebSocketStream regressions. It also updates documentation and security guidance around buffering response bodies, and adds regression tests around native fetch behavior when routed through the legacy dispatcher bridge.
v8.11.0
v8.11.0 is a maintenance release with many targeted fixes across cookies, decompression, proxy agents, HTTP/2 session handling, retry and deduplication behavior, and upgrade diagnostics. It also includes multiple dependency bumps and documentation updates around Agent/Pool behavior and newly documented errors such as ProxyConnectionError.
Securityv7.29.1
v7.29.1 is primarily a security release, listing multiple GHSA advisories across WebSocket, caching, decompression, and HTTP retry behaviors, plus several HTTP/2 fixes and a small benchmarking/performance tweak. The release notes also include a number of CI and workflow maintenance changes.
Securityv6.28.1
v6.28.1 release notes describe three security fixes (WebSocket handshake protocol error handling, decompression limit handling for permessage-deflate, and retry interceptor response framing validation) plus two small performance improvements. The actual code changes include additional API surface and behavior changes (new `dns` interceptor, WebSocket option support, new Fetch body `bytes()` support) and stricter request validation and protocol handling that are not mentioned in the release notes.
BreakingSecurityFeaturesv8.10.2
Undici v8.10.2 is primarily a security release, addressing multiple high and medium severity issues across caching, decompression, retry, and WebSocket behavior. It also includes several bug fixes, plus a small number of dependency and CI/build bumps.
BreakingSecurityFeaturesv8.10.1
undici v8.10.1 primarily delivers a batch of bug fixes across mocks, retry handling, caching, proxy agent behavior, and HTTP/2 and EventSource edge cases. It also includes a couple of targeted performance tweaks around fetch and idle-socket validation. There are dependency bumps for several dev dependencies used in the build/test toolchain.
v8.10.0
undici v8.10.0 focuses on HTTP/2 option namespacing via a new h2Options object, plus a series of targeted fixes around request settlement, retry behavior, and encoding/stream edge cases. The release also includes improvements for WebSocket unref support and proxy no_proxy handling for bare IPv6 addresses.
Featuresv6.28.0
This release (v6.28.0) adds new public API surface around interceptors (notably a new DNS interceptor) and WebSocket configuration, along with several internal changes to timers, request header handling, and HTTP/1 and HTTP/2 client behavior. Release notes provided here contain only a compare link and do not enumerate changes, so the code diff is the primary source for what actually shipped.
Featuresv7.29.0
Release v7.29.0 has essentially no release-note content beyond a link to the full changelog. The actual diff shows substantive internal HTTP parser changes (llhttp), plus notable API documentation changes around `Agent` options.
BreakingFeatures