Security: Upgrade Undici to v8.9.0 / v7.29.0 / v6.28.0 (5 advisories, 1 high, 4 medium)

Undici has released v8.9.0, v7.29.0, and v6.28.0, fixing five security advisories (one high severity, four medium). Our application uses Undici directly, or uses fetch(), we are using Undici and should upgrade.

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in a shared cache, or crash the parser at parse time. The cache parser now conservatively handles empty and mixed qualified/unqualified directives. Affects v7 and v8.

Medium severity

• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Affects v7 and v8.
• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, which can cause response desynchronization, hangs or corruption downstream. Partial responses whose Content-Length is inconsistent with Content-Range are now rejected.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes.

The release also includes a defense-in-depth change: non-string header values are validated after coercion, including array elements, so crafted toString() or Symbol.toPrimitive implementations cannot introduce CRLF sequences.

Upgrade

npm install undici@^8.9.0 # or ^7.29.0, or ^6.28.0

Note: Undici v6 is affected by three of the five advisories; the two cache-interceptor issues are outside its scope.

Action items

• Check which version of Undici this project depends on (directly or transitively)
• Upgrade to the patched version (^8.9.0, ^7.29.0, or ^6.28.0)