Bump undici from 6.26.0 to 6.28.0

[dependabot]

Bumps undici from 6.26.0 to 6.28.0.

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	b7f252e7
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	25efa447
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	25efa447
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	f4c31d60

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• 551138c Bumped v6.27.0 (#5431)
• b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
• 25efa44 fix(cookies): preserve values and parse SameSite strictly
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because it remediates 7 OSV-validated CVEs (1 high, 3 medium, 3 low severity) spanning WebSocket denial-of-service, cookie header injection, SameSite bypass, idle-socket response injection, blob CRLF injection, retry-interceptor desynchronization, and setCookie() attribute injection vulnerabilities — all fixed in the target versions. In this repository, undici appears exclusively as a transitive devDependency pulled in by node-gyp; it is not imported anywhere in application or test code. The behavioral breaking changes introduced across the two intermediate releases — stricter WebSocket fragment limits, cookie percent-decoding removal, SameSite exact-match enforcement, and stricter setCookie() domain validation — do not affect this project because undici is never called directly. The typosquatting alert in context refers to undicy-http, a distinct package unrelated to this upgrade.

What we checked

• undici is a transitive dependency of node-gyp (declared as ^6.25.0), which is a devDependency of this project. It is not a direct runtime or dev dependency of the project itself. ^[1]
• Resolved undici version in the lockfile is 6.28.0 (the upgrade target), marked "dev": true, confirming it is only present in the dev dependency tree. ^[2]
• node-gyp is listed under devDependencies, confirming that the entire undici dependency chain is dev-only and not shipped with the published package. ^[3]
• CVE-2026-12151 (high) and CVE-2026-9679, CVE-2026-11525, CVE-2026-6733 (medium/low) are all fixed in 6.27.0; CVE-2026-16729, CVE-2026-16728, CVE-2026-15157 (medium) are fixed in 6.28.0. This upgrade moves from 6.26.0 to 6.28.0, resolving all 7 validated vulnerabilities. ^[4]
• Behavioral breaking changes (WebSocket fragment limit enforcement, cookie percent-decoding removal, SameSite exact-match, stricter setCookie() validation) were introduced across 6.27.0–6.28.0. These do not impact this project because undici is not directly imported or called anywhere in the codebase. ^[5]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

Changes

undici was updated to address 8 security vulnerabilities, including CRLF injection via blob content-type headers, WebSocket denial-of-service via unbounded message fragmentation, cookie header injection from percent-decoded values and unsanitized setCookie() inputs, improper SameSite attribute parsing, stale Content-Length exposure in the retry interceptor, and response injection via idle socket reuse on HTTP/1.1 keep-alive connections. No workarounds exist for most of these issues — upgrading undici is required.

• Upgraded undici to version 6.27.0 to address 4 security advisories (v6.26.0-6.27.0, release notes)
• Fixed WebSocket maxPayloadSize vulnerability ([REDACTED-GHSA] / [REDACTED-CVE]) by limiting the number of fragments per message to prevent unbounded memory growth and denial of service attacks from malicious WebSocket servers (v6.26.0-6.27.0, release notes)
• Fixed cookie parsing vulnerability ([REDACTED-GHSA] / [REDACTED-CVE]) by removing percent-decoding from cookie values to prevent header injection attacks and comply with RFC 6265 (v6.26.0-6.27.0, release notes)

View 28 more changes

• Fixed SameSite cookie attribute parsing vulnerability ([REDACTED-GHSA] / [REDACTED-CVE]) by requiring exact matches instead of substring matches to prevent security policy weakening (v6.26.0-6.27.0, release notes)
• Fixed idle socket validation vulnerability ([REDACTED-GHSA] / [REDACTED-CVE]) to prevent response injection attacks on HTTP/1.1 keep-alive connections (v6.26.0-6.27.0, release notes)
• [REDACTED-GHSA]: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c. (v6.27.0-6.28.0, release notes)
• [REDACTED-GHSA]: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by [cba3a52a](https://redirect.github.... (v6.27.0-6.28.0, release notes)
• [REDACTED-GHSA]: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404. (v6.27.0-6.28.0, release notes)
• #5400 — idle-socket-validation fix for the queue-poisoning issue ([REDACTED-CVE]). (v6.26.0-6.27.0, release notes)
• [REDACTED-CVE] — reported by @​tndud042713; fixed by @​mcollina; reviewed by @​KhafraDev & @​UlisesGascon. (v6.26.0-6.27.0, release notes)
• [REDACTED-CVE] — fixed by @​mcollina; reviewed by @​UlisesGascon. (v6.26.0-6.27.0, release notes)
• Note: v6.26.0 contains only the chunked-EOF fix and version bump, not the security fixes listed above (v6.26.0-6.27.0, release notes)
• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints. (v6.26.0-6.27.0, release notes)
• Workaround: none — upgrade is required. (v6.26.0-6.27.0, release notes)
• Workaround: sanitize values before forwarding — strip or reject CR, LF, NUL, ;, and =. (v6.26.0-6.27.0, release notes)
• Requirements: attacker-controlled/compromised upstream and active keep-alive reuse. (v6.26.0-6.27.0, release notes)
• Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the Client or Pool. (v6.26.0-6.27.0, release notes)
• #5428 — backport of the WebSocket maxPayloadSize fragment-count / cumulative-size limits to v6.x ([REDACTED-CVE]; this is the v6 counterpart of the v7 backport #5423). (v6.26.0-6.27.0, release notes)
• [REDACTED-CVE] — reported by @​lpinca & @​Nadav0077; reviewed by @​UlisesGascon. (v6.26.0-6.27.0, release notes)
• Backported WebSocket maxPayloadSize fixes to v7.x (v6.26.0-6.27.0, commit)
• Fixed cookies to preserve values and parse SameSite strictly (v6.26.0-6.27.0, commit)
• Fixed idle socket validation to skip fresh sockets (v6.26.0-6.27.0, commit)
• Correct broken content-range fixtures in retry-handler.js (v6.27.0-6.28.0, commit)
• Bumped to v6.27.0 (v6.26.0-6.27.0, commit)
• Validate blob body content type (v6.27.0-6.28.0, commit)
• Validate coerced header values for CRLF (v6.27.0-6.28.0, commit)
• Reject partial content length mismatch in retry handler (v6.27.0-6.28.0, commit)
• Harden cookie domain, path, and unparsed attribute validation (v6.27.0-6.28.0, commit)
• Added new optional maxFragments configuration option to WebSocketOptions. Allows limiting the maximum number of fragments in a WebSocket message (default: 131072). Set to 0 to disable the limit. Helps prevent denial-of-service attacks via message fragmentation. (v6.27.0, package source)
• Updated WebSocket documentation to include the new maxFragments configuration option (v6.27.0, package source)
• Version bump from 6.27.0 to 6.28.0 - patch version release (v6.28.0, package source)

References (5)

[1]: undici is a transitive dependency of node-gyp (declared as ^6.25.0), which is a devDependency of this project. It is not a direct runtime or dev dependency of the project itself.

minidrone-js/package-lock.json

Line 2343 in ab4ce46

"undici": "^6.25.0",

[2]: Resolved undici version in the lockfile is 6.28.0 (the upgrade target), marked "dev": true, confirming it is only present in the dev dependency tree.

minidrone-js/package-lock.json

Line 3242 in ab4ce46

"node_modules/undici": {

[3]: node-gyp is listed under devDependencies, confirming that the entire undici dependency chain is dev-only and not shipped with the published package.

minidrone-js/package.json

Line 36 in ab4ce46

"node-gyp": "^12.0.0",

[4]: CVE-2026-12151 (high) and CVE-2026-9679, CVE-2026-11525, CVE-2026-6733 (medium/low) are all fixed in 6.27.0; CVE-2026-16729, CVE-2026-16728, CVE-2026-15157 (medium) are fixed in 6.28.0. This upgrade moves from 6.26.0 to 6.28.0, resolving all 7 validated vulnerabilities. (source link)

[5]: Behavioral breaking changes (WebSocket fragment limit enforcement, cookie percent-decoding removal, SameSite exact-match, stricter setCookie() validation) were introduced across 6.27.0–6.28.0. These do not impact this project because undici is not directly imported or called anywhere in the codebase. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web

[fossabot]