nodejs / nodejs/nodejs-dependency-vuln-assessments
undici updates
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
We did a follow-up to Undici release https://nodejs.org/en/blog/vulnerability/march-2026-security-releases specifically for WebSocket max decompressed message size. https://github.com/nodejs/undici/issues/4944.
We should update:
- Node 24 to Undici v7.25
- Node 22 to Undici v6.25
@nodejs/releasers should I send PRs here? Or shall we wait the next security release?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking how this repository records Undici versions for Node 24 and Node 22, then review the referenced Node security release and Undici issue. Done means the relevant references use Undici v7.25 for Node 24 and v6.25 for Node 22, with the contribution path confirmed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100