FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Comparing v6.27.0...v6.28.1 · nodejs/undici · GitHub

  1. nodejs
  2. undici

Repository navigation

Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/undici
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v6.27.0
Choose a base ref
Could not load branches
Nothing to show
{{ refName }}
...
head repository: nodejs/undici
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v6.28.1
Choose a head ref
Could not load branches
Nothing to show
{{ refName }}
  • 13 commits
  • 21 files changed
  • 7 contributors

Commits on Jul 23, 2026

  1. fix: harden cookie domain, path, and unparsed attribute validation 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    KhafraDev authored and mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    af74840 View commit details
    Browse the repository at this point in the history

  2. fix(retry): reject partial content length mismatch 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    cba3a52 View commit details
    Browse the repository at this point in the history

  3. test(retry): correct broken content-range fixtures in retry-handler.js 

    Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
    UlisesGascon authored and mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    4fd5a0c View commit details
    Browse the repository at this point in the history

Commits on Jul 24, 2026

  1. fix: validate coerced header values for CRLF (#5579) 

    Functions bypassed the object guard in processHeader() and were
coerced via template literals without isValidHeaderValue(), allowing
CRLF injection when toString/Symbol.toPrimitive returned embedded
newlines. Validate after coercion on both scalar and array paths.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit 354a151)
    mcollina committed Jul 24, 2026
    Configuration menu
    Copy the full SHA
    2698e49 View commit details
    Browse the repository at this point in the history

  2. fix: validate blob body content type

    mcollina committed Jul 24, 2026
    Configuration menu
    Copy the full SHA
    740a0b7 View commit details
    Browse the repository at this point in the history

  3. Use Node 22 and npm 11 to release 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    mcollina committed Jul 24, 2026
    Configuration menu
    Copy the full SHA
    481ecfc View commit details
    Browse the repository at this point in the history

  4. Bumped v6.28.0 (#5591) 

    Co-authored-by: github-actions <github-actions@github.com>
    2 people authored and mcollina committed Jul 24, 2026
    Configuration menu
    Copy the full SHA
    01a912e View commit details
    Browse the repository at this point in the history

Commits on Aug 4, 2026

  1. perf: reduce EventSourceStream parser allocations (#5032) (#5647) 

    Assisted-by: OpenAI:gpt-5.4

(cherry picked from commit aeed21a)

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Co-authored-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
    mcollina and trivikr authored Aug 4, 2026
    Configuration menu
    Copy the full SHA
    bd90fff View commit details
    Browse the repository at this point in the history

Commits on Sep 4, 2026

  1. fix(websocket): destroy inflater after decompression limit 

    Stop the permessage-deflate inflater after removing its listeners so a late zlib error cannot become an uncaught exception. Add regression coverage for malformed compressed payloads that exceed the configured limit.

Fixes: GHSA-3wwx-pv8p-q78v
CVE: CVE-2026-85024
Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit fa45246280698732d8822571da3ae650a8cdfa10)
(cherry picked from commit 96f455485e0ccd224c839f2478b7dad0b53c1b1e)
    mcollina committed Sep 4, 2026
    Configuration menu
    Copy the full SHA
    07c60d9 View commit details
    Browse the repository at this point in the history

  2. fix(websocket): reject unrequested subprotocols 

    Guard the opening-handshake protocol check when the client did not request any subprotocols. Fail the WebSocket connection with protocol error 1002 instead of allowing a TypeError to escape from the response microtask and terminate the process.

Fixes: GHSA-rfgv-xxqx-mfg5
CVE: CVE-2026-19534
Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit 3e2c9c7210ce437636e58df4804fa7d689d5ca7a)
    mcollina committed Sep 4, 2026
    Configuration menu
    Copy the full SHA
    2af0faf View commit details
    Browse the repository at this point in the history

  3. fix(retry): validate resumed response framing 

    Checkpoint the original response framing before exposing headers and reject resumed responses whose Content-Range does not match it. Do not retry after an exposed response without a resumable length, preventing attacker-controlled retry responses from being concatenated into downstream output.

Fixes: GHSA-r53p-7pc4-xj5r
CVE: CVE-2026-18540
Signed-off-by: Matteo Collina <hello@matteocollina.com>
    mcollina committed Sep 4, 2026
    Configuration menu
    Copy the full SHA
    ce31bc8 View commit details
    Browse the repository at this point in the history

  4. perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707… 

    …) (#5770)

(cherry picked from commit 8c9182e)
Signed-off-by: Matteo Collina <hello@matteocollina.com>

# Conflicts:
#	test/node-test/keep-alive-reuse.js

Co-authored-by: Yagiz Nizipli <yagiz@nizipli.com>
    mcollina and anonrig authored Sep 4, 2026
    Configuration menu
    Copy the full SHA
    3866a3b View commit details
    Browse the repository at this point in the history

  5. Bumped v6.28.1 (#5773) 

    Co-authored-by: github-actions <github-actions@github.com>
    github-actions[bot] and github-actions authored Sep 4, 2026
    Configuration menu
    Copy the full SHA
    ffc8aa0 View commit details
    Browse the repository at this point in the history
Loading
Back | FazBrowse Home | New Git URL