What's Changed

• feat: namespace h2 options by @metcoder95 in #5498
• test: update WPT expectations by @mcollina in #5587
• test: add cache/dedupe + dns re-dispatch integration tests by @GiHoon1123 in #5535
• fix(websocket): support process.unref by @mcollina in #5578
• fix(h2): ensure every request settles by @mcollina in #5603
• fix(readable): consume a body whose end has already been emitted by @marko1olo in #5617
• fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @marko1olo in #5610
• fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @marceli1404 in #5606
• fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @marko1olo in #5623
• test: handle aggregate balanced pool errors by @marko1olo in #5377
• fix(readable): keep body bytes that arrive after setEncoding() by @mcollina in #5620
• fix(socks5): evict unused origin pools by @Kkartik14 in #5595
• fix: skip deduplication for upgrade requests by @Ram-blip in #5593
• fix(retry): forward informational responses by @mcollina in #5625
• fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @marko1olo in #5619
• fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @marko1olo in #5628
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #5633
• build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @dependabot[bot] in #5634
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #5636
• fix(mock): emit request body lifecycle hooks by @marko1olo in #5367
• fix(h2): detach upgrade close handler after GOAWAY by @pacocartones in #5641
• fix: retry refused HTTP/2 streams by @mcollina in #5598
• fix: preserve DNS origin hostname on sockets by @cyphercodes in #5577

New Contributors

• @marceli1404 made their first contribution in #5606
• @Kkartik14 made their first contribution in #5595
• @pacocartones made their first contribution in #5641
• @cyphercodes made their first contribution in #5577

Full Changelog: v8.9.0...v8.10.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @Ram-blip in #5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @dependabot[bot] in #5576
• fix: validate coerced header values for CRLF by @mcollina in #5579
• fix: handle frozen globalThis in setGlobalDispatcher by @mhayk in #5574
• Ignore auto-generated .npmrc on Windows by @tsctx in #5583

New Contributors

• @mhayk made their first contribution in #5574

Full Changelog: v8.8.0...v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: v7.28.0...v7.29.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: v6.27.0...v6.28.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @KhafraDev in #5517
• fix(benchmarks): adjust got after v15 upgrade by @slagiewka in #5526
• feat(mock): support asynchronous reply options callbacks by @Develop-KIM in #5534
• docs: clarify proxy threat model by @mcollina in #5530
• docs: clarify MockAgent pool usage by @vibhor-aggr in #5542
• docs: clarify parser timeout precision by @vibhor-aggr in #5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @mcollina in #5536
• chore(benchmarks): require(esm) on ESM-only packages by @slagiewka in #5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @carlotestor in #5499
• docs: add custom interceptor example by @vibhor-aggr in #5548
• fix(h1): ignore type of service errors by @mcollina in #5547
• fix(fetch): convert null init in Response.json by @Ram-blip in #5540
• fix(redirect): remove body headers after POST-to-GET by @Ram-blip in #5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @dependabot[bot] in #5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @GiHoon1123 in #5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @staylor in #5559
• fix(decompress): skip HEAD responses by @Ram-blip in #5564
• ci: build undici with node.js v26 by @shivarm in #5237
• docs: clarify top-level request option url fields by @vibhor-aggr in #5545
• test: add unexpected disconnect guards to http2 tests by @Develop-KIM in #5533
• fix: track origins by client map key in Agent teardown by @emmayusufu in #5537
• fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @jeswr in #5511
• fix(retry): handle Retry-After zero delay by @Ram-blip in #5519
• fix: honor stale-if-error on connection errors during revalidation by @jeswr in #5513
• fix: store revalidation-only responses so etag revalidation can engage by @jeswr in #5515
• fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @mcollina in #5546
• fix(h2): complete request stream on 'end' instead of waiting for 'close' by @staylor in #5560
• fix: invalidate Location and Content-Location URIs on unsafe methods by @jeswr in #5514
• test: deflake invalid websocket close status test by @mcollina in #5550
• refactor: replace tspl with node:test t.plan in connect-timeout tests by @mcollina in #5518
• fix(h2): release completed requests from queue by @staylor in #5569

New Contributors

• @Develop-KIM made their first contribution in #5534
• @carlotestor made their first contribution in #5499
• @GiHoon1123 made their first contribution in #5538
• @emmayusufu made their first contribution in #5537

Full Changelog: v8.7.0...v8.8.0

What's Changed

• test: guard balanced-pool error port lookup by @mcollina in #5463
• perf: optimize http/2 request hot path by @mcollina in #5483
• fix: do not reject open-ended Range values in simpleRangeHeaderValue by @spokodev in #5490
• fix(eventsource): set use-URL-credentials flag by @Ram-blip in #5489
• test: deflake connect-timeout watchdog by @mcollina in #5197
• docs: correct npm script name and JSON syntax in examples by @lenoxfernando in #5496
• fix: reject non-ascii octets in validateCookiePath by @spokodev in #5452
• fix(readable): ignore late consume chunks by @marko1olo in #5375
• fix(h2): destroy the stream on abort instead of relying on close() by @staylor in #5462
• fix: ignore an unparseable Set-Cookie Expires attribute by @spokodev in #5488
• docs: add reproduction guide and update bug report template by @mcollina in #5451
• fix(h2): guard onResponse against a 'response' event delivered after completion by @staylor in #5440
• fix(h2): requeue request on GOAWAY'd session instead of crashing by @staylor in #5453
• fix: add static buildDispatch method to RedirectHandler type definition by @matthieusieben in #5442
• fix: auto-detect HTTP proxy tunneling by @mcollina in #5116

New Contributors

• @spokodev made their first contribution in #5490
• @lenoxfernando made their first contribution in #5496
• @staylor made their first contribution in #5462

Full Changelog: v8.6.0...v8.7.0

What's Changed

• build(deps-dev): bump proxy from 4.0.0 to 4.1.0 by @dependabot[bot] in #5433
• update accept-encoding header in fetch by @KhafraDev in #5439
• fix: drop response chunks after the response stream is destroyed (#5356) by @cesarvspr in #5357
• fix: handle incomplete multi-byte UTF-8 sequences in setEncoding() by @joecwu in #5003
• fix(retry): keep flow-control wired to the active connection across resumes by @bogomya in #5405
• test: cover connect lookup option by @vibhor-aggr in #5411
• test: fail on unexpected reconnect disconnect by @vibhor-aggr in #5412
• build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #5419
• fix(proxy): fail the request when the CONNECT tunnel drops instead of looping by @cesarvspr in #5441
• feat(docs): migrate to doc-kit by @avivkeller in #5438
• build(deps-dev): bump undici from 6.25.0 to 6.27.0 by @dependabot[bot] in #5445
• fetch: fix issue 4058 by @KhafraDev in #5456
• docs: add Interceptors API reference page by @enjoykumawat in #5446
• Document H1 keep-alive trust tradeoff by @mcollina in #5457
• fix(h2): deliver an early final response to an Expect: 100-continue request by @jeswr in #5470
• fix(types): correct deleteCookie attributes by @Ram-blip in #5461
• fix(h1): complete paused parser on socket end instead of crashing by @ronag in #5474
• build(deps): bump github/codeql-action/init from 4.36.1 to 4.36.2 by @dependabot[bot] in #5476
• build(deps): bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 by @dependabot[bot] in #5481
• build(deps): bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @dependabot[bot] in #5480
• build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #5478
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #5482
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @trivikr in #5484
• build(deps): bump github/codeql-action/analyze from 4.36.1 to 4.36.2 by @dependabot[bot] in #5477
• feat: support HTTP QUERY method (RFC 10008) by @mcollina in #5459
• fix: requeue h2 requests after goaway by @mcollina in #5473

New Contributors

• @joecwu made their first contribution in #5003
• @bogomya made their first contribution in #5405
• @enjoykumawat made their first contribution in #5446
• @jeswr made their first contribution in #5470
• @Ram-blip made their first contribution in #5461

Full Changelog: v8.5.0...v8.6.0

⚠️ Security Release

This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.

Action required: Upgrade to undici 8.5.0 or later.

npm install undici@^8.5.0

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 32dbf0b3 websocket: limit the number of fragments in a message (also c5ed7875 handle empty fragments and stream limits)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream
  against untrusted endpoints.
• Workaround: none — upgrade is required.

WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

GHSA-38rv-x7px-6hhq · CWE-400, CWE-770
Fix: b4c287b3 fix(websocket): enforce max payload size across fragments

Undici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).

• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295
Fix: 42d49559 fix: honor requestTls when proxy is SOCKS5

The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.

• Affected: ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on
  requestTls.
• Workaround: route traffic through an HTTP-proxy ProxyAgent, where
  requestTls functions correctly.

Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0
Fix: a516f870 fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)

Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.

• Affected: applications using Socks5ProxyAgent across multiple origins
  (introduced via #4385).
• Workaround: use a separate agent instance per origin.

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

GHSA-pr7r-676h-xcf6 · CWE-524
Fix: cb105d7c fix(cache): trim qualified field names

The cache interceptor mishandled responses with whitespace-padded
Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.

• Affected: apps using the cache interceptor in shared mode that forward
  Authorization upstream and receive non-canonical qualified directives.
• Workaround: disable shared-cache mode for authenticated traffic, avoid
  caching authenticated responses, or add Vary: Authorization upstream.

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#3789.

• Workaround: sanitize values before forwarding — strip or reject CR, LF,
  NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: 6ea54ef8 fix: guard idle socket validation to skip fresh sockets, hardened by c9fbe9d2 keep idle validation on native timers (#5397) and ac5394b8 keep idle validation on global timers (#5407)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

• Requirements: attacker-controlled/compromised upstream and active
  keep-alive reuse.
• Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
  Client or Pool.

Also in v8.5.0 (non-security)

v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #5397
and #5407, are covered under
CVE-2026-6733 above and are not repeated here.)

• HTTP/2: #5408 don't rewind kPendingIdx past in-flight requests · #5391 allow h2 POST request multiplexing · #5406 reap idle HTTP/2 sessions · #5410 preserve h2 queue on out-of-order completion
• Features: #5416 add bodyMixin.textStream() · #5418 align EventSource with spec
• Docs / CI / tests: #5413 document request header validation · [#5383](...

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is
an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the
earlier 7.2x line — the vulnerable single-pool code was still present through
v7.27.2. The per-origin pool fix is
3805b8f8 (#5041).

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream
  against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295
Fix: 04201f89 fix: honor requestTls when proxy is SOCKS5 (#5417)

The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.

• Affected: ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on
  requestTls.
• Workaround: route traffic through an HTTP-proxy ProxyAgent, where
  requestTls functions correctly.

Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

GHSA-hm92-r4w5-c3mj · CWE-346
Fix: 3805b8f8 fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)

Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.

• Affected: applications using Socks5ProxyAgent across multiple origins
  (introduced in 7.23.0 via #4385).
• Workaround: use a separate agent instance per origin.

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

GHSA-pr7r-676h-xcf6 · CWE-524
Fix: 85a24055 fix(cache): trim qualified field names

The cache interceptor mishandled responses with whitespace-padded
Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.

• Affected: apps using the cache interceptor in shared mode that forward
  Authorization upstream and receive non-canonical qualified directives.
• Workaround: disable shared-cache mode for authenticated traffic, avoid
  caching authenticated responses, or add Vary: Authorization upstream.

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: d0574cc4 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#3789.

• Workaround: sanitize values before forwarding — strip or reject CR, LF,
  NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: d0574cc4 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: ea8930cf fix: guard idle socket validation to skip fresh sockets, hardened by 8e4046e4 keep idle validation on native timers (#5402) and 0fa80869 keep idle validation on global timers (#5409)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

• Requirements: attacker-controlled/compromised upstream and active
  keep-alive reuse.
• Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
  Client or Pool.

Release contents & deliberate backports

v7.28.0 is a security-only release — every change in it is one of the fixes
above, backported to the v7.x maintenance line on purpose from the v8
development line:

• #5423 — backport of the WebSocket maxPayloadSize fragment-count / cumulative-size limits (CVE-2026-12151).
• #5402 & #5409 — backport of the idle-validation hardening (native + global timers) for the queue-poisoning fix (CVE-2026-6733).
• #5417 — requestTls over SOCKS5 fix (CVE-2026-9697).

The cookie (d0574cc4),
cache (85a24055) and
queue-poisoning core (ea8930cf)
fixes were applied directly to the v7.x branch. Full changelog:
v7.27.2...v7.28.0.

Credits

Per-advisory credits (as recorded in each GHSA):

• CVE-2026-12151 — reported by @lpinca & @Nadav0077; reviewed by @UlisesGascon.
• CVE-2026-9697 — reported by @tonghuaroot; reviewed by @UlisesGascon.
• CVE-2026-6734 — reported by [@ChALkeR](https://github.co...

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0
— v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none
of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g,
GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the
8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service. All releases from 6.17.0 onward are affected.

• Affected: applications using new WebSocket(...) or WebSocketStream
  against untrusted endpoints.
• Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: 25efa447 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning.

• Workaround: sanitize values before forwarding — strip or reject CR, LF,
  NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: 25efa447 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: f4c31d60 fix: guard idle socket validation to skip fresh sockets (#5400)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

• Requirements: attacker-controlled/compromised upstream and active
  keep-alive reuse.
• Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
  Client or Pool.

Release contents & deliberate backports

v6.27.0 is a security-only release — every change in it is one of the fixes
above, backported to the v6.x maintenance line on purpose:

• #5428 — backport of the WebSocket maxPayloadSize fragment-count / cumulative-size limits to v6.x (CVE-2026-12151; this is the v6 counterpart of the v7 backport #5423).
• #5400 — idle-socket-validation fix for the queue-poisoning issue (CVE-2026-6733).

The cookie fix (25efa447,
covering both CVE-2026-9679 and CVE-2026-11525) was applied directly to the v6.x
branch. Full changelog:
v6.26.0...v6.27.0.

Credits

Per-advisory credits (as recorded in each GHSA):

• CVE-2026-12151 — reported by @lpinca & @Nadav0077; reviewed by @UlisesGascon.
• CVE-2026-9679 — reported by @tndud042713; fixed by @mcollina; reviewed by @KhafraDev & @UlisesGascon.
• CVE-2026-11525 — fixed by @mcollina; reviewed by @UlisesGascon.
• CVE-2026-6733 — fixed by @mcollina; verified by @UlisesGascon.