AIKIDO-2026-10939
undici is vulnerable to Improper Input Validation
65
Medium Risk
This Affects:
undiciTL;DR
Undici contains related HTTP response validation and request deduplication weaknesses in its client runtime. A peer can close a chunked HTTP/1.1 response before the terminating chunk and make the library treat truncated data as complete, while crafted deduplication headers can collide and cause concurrent requests to share the wrong origin response when the deduplicate interceptor is enabled. Applications that trust response bodies or deduplicated responses for integrity decisions may act on incomplete or cross-request data. The fix validates EOF through the parser finish path and uses structured JSON encoding for deduplication keys.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
undici is vulnerable to Improper Input Validation in versions 7.0.0 - 7.25.0.
How to fix this
Upgrade the undici library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant