Undici is an HTTP/1.1 client written from scratch for Node.js. It is useful for making HTTP requests, and it also provides APIs like fetch, request, streaming helpers, and connection pooling configuration.
Project status
- Actively maintained: The latest upstream push is 2026-10-15, and multiple undici updates (v8.12.1, v8.12.0, v8.11.x) landed within the last few weeks, indicating ongoing development and responsiveness to issues.
- Update cadence: Evidence suggests a high cadence in Oct 2026 (two v8.12.x updates within a day) and steady releases in late Sep 2026 (several v7/v6/v8 updates across 9/04 to 9/25), so maintenance is not “quiet” relative to today.
AI summary generated
Recent updates
v8.12.2
Release v8.12.2 is presented as a security update to undici, addressing multiple denial of service issues and TLS certificate validation bypasses, plus an SRI validation bypass. The release notes describe how undici avoids crashes and preserves TLS option behavior, and adds bounds and validation to prevent resource exhaustion and cache poisoning.
Securityv6.29.1
v6.29.1 primarily ships security fixes covering multiple denial-of-service scenarios and TLS validation issues in undici, plus a single documented fetch-related fix around aborting Streams. Despite the release notes focusing on those items, the code diff shows additional functional additions and tighter validation/behavior changes that are not mentioned in the release notes.
BreakingSecurityFeaturesv7.30.1
v7.30.1 is primarily a security release for undici, addressing multiple denial of service vectors and validation bypasses affecting fetch, TLS handling, caching, decompression, SRI, EventSource parsing, and WebSocket PONG backpressure. The release notes enumerate several CVEs and describe mitigation behavior at a feature level, but they do not mention lower-level HTTP parsing changes to the vendored llhttp dependency.
Securityv8.12.1
v8.12.1 primarily includes a build script restoration for the WASM build workflow, plus additional HTTP/2 test guards to catch unexpected disconnect behavior. The code changes are limited to package metadata, a package.json script, and updates to a single test file.
v8.12.0
v8.12.0 contains a large set of targeted bug fixes across cookies, HTTP/1 and HTTP/2 behavior, caching layers, redirects, eventsource, retry/resume flows, and various edge cases. It also introduces experimental Milo parser-related work, including a change to throw an error when WebAssembly is not available, plus several CI and documentation updates.
BreakingFeaturesv6.29.0
v6.29.0 release notes only mention a retry fix and some diagnostics lifecycle and timeout synchronization. The code diff, however, contains additional externally visible API and behavior changes including new interceptors and WebSocket/Body/Diagnostics enhancements, plus stricter request header validation logic that can cause new runtime errors.
BreakingFeaturesv7.30.0
v7.30.0 backports several fixes to undici, including updates to fetch and decompression behavior, HTTP/2 WebSocket cleanup, and diagnostics lifecycle adjustments. It also selectively re-enables wasm SIMD on ppc64 for Node versions where it is no longer known-broken.
v8.11.2
v8.11.2 contains two targeted fixes related to HTTP/2 behavior. It improves robustness around rejected HTTP/2 WebSocket handshakes and prevents aborted requests from triggering unintended reconnect behavior.
v8.11.1
undici v8.11.1 focuses on fixing WebSocket and fetch edge cases, including a hang on 3xx responses with large bodies, and multiple WebSocketStream regressions. It also updates documentation and security guidance around buffering response bodies, and adds regression tests around native fetch behavior when routed through the legacy dispatcher bridge.
v8.11.0
v8.11.0 is a maintenance release with many targeted fixes across cookies, decompression, proxy agents, HTTP/2 session handling, retry and deduplication behavior, and upgrade diagnostics. It also includes multiple dependency bumps and documentation updates around Agent/Pool behavior and newly documented errors such as ProxyConnectionError.
Securityv7.29.1
v7.29.1 is primarily a security release, listing multiple GHSA advisories across WebSocket, caching, decompression, and HTTP retry behaviors, plus several HTTP/2 fixes and a small benchmarking/performance tweak. The release notes also include a number of CI and workflow maintenance changes.
Securityv6.28.1
v6.28.1 release notes describe three security fixes (WebSocket handshake protocol error handling, decompression limit handling for permessage-deflate, and retry interceptor response framing validation) plus two small performance improvements. The actual code changes include additional API surface and behavior changes (new `dns` interceptor, WebSocket option support, new Fetch body `bytes()` support) and stricter request validation and protocol handling that are not mentioned in the release notes.
BreakingSecurityFeaturesv8.10.2
Undici v8.10.2 is primarily a security release, addressing multiple high and medium severity issues across caching, decompression, retry, and WebSocket behavior. It also includes several bug fixes, plus a small number of dependency and CI/build bumps.
BreakingSecurityFeaturesv8.10.1
undici v8.10.1 primarily delivers a batch of bug fixes across mocks, retry handling, caching, proxy agent behavior, and HTTP/2 and EventSource edge cases. It also includes a couple of targeted performance tweaks around fetch and idle-socket validation. There are dependency bumps for several dev dependencies used in the build/test toolchain.
v8.10.0
undici v8.10.0 focuses on HTTP/2 option namespacing via a new h2Options object, plus a series of targeted fixes around request settlement, retry behavior, and encoding/stream edge cases. The release also includes improvements for WebSocket unref support and proxy no_proxy handling for bare IPv6 addresses.
Featuresv6.28.0
This release (v6.28.0) adds new public API surface around interceptors (notably a new DNS interceptor) and WebSocket configuration, along with several internal changes to timers, request header handling, and HTTP/1 and HTTP/2 client behavior. Release notes provided here contain only a compare link and do not enumerate changes, so the code diff is the primary source for what actually shipped.
Featuresv7.29.0
Release v7.29.0 has essentially no release-note content beyond a link to the full changelog. The actual diff shows substantive internal HTTP parser changes (llhttp), plus notable API documentation changes around `Agent` options.
BreakingFeaturesv8.9.0
undici v8.9.0 includes a small set of targeted fixes around HTTP decompression behavior, header validation, global dispatcher initialization, and a Windows-specific workaround. The release notes also include a dependency bump for ws. However, the provided diff indicates a much larger change set overall, with substantial documentation rework that is not covered by the release notes.
Breakingv8.8.0
undici v8.8.0 includes a mix of HTTP client fixes, MockAgent improvements, and cache correctness changes. Notable items include switching fetch body cloning to use ReadableStreamTee, adding support for asynchronous MockAgent reply options callbacks, and multiple robustness fixes in the HTTP/2 dispatcher. Release notes also include several documentation clarifications and CI updates (including Node.js v26).
Featuresv8.7.0
undici v8.7.0 focuses on HTTP/2 robustness and proxy behavior fixes, alongside several correctness fixes (Range, cookies, EventSource credential handling). It also includes a TypeScript type definition enhancement for RedirectHandler and multiple test/docs improvements.
Features