Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Undici library can let attackers run code

CVE-2026-109383 · published 5 days ago
Summary

The Undici package used in Node.js applications had a flaw that could let a remote attacker execute code on your server. This could lead to unauthorized access or data loss. Update to the latest fixed version of Undici as soon as possible.

What to do
  • Update undici to version 5.29.0-aikido.6.
  • Update rootio @rootio/undici to version 5.29.0-root.io.6.
  • Update undici to version 5.28.5-aikido.4.
  • Update rootio @rootio/undici to version 5.28.5-root.io.4.
  • Update undici to version 5.28.4-aikido.6.
  • Update rootio @rootio/undici to version 5.28.4-root.io.6.
  • Update undici to version 6.29.1.
  • Update undici to version 7.30.1.
  • Update undici to version 8.12.2.
  • Update undici to version 6.28.0-aikido.2.
  • Update rootio @rootio/undici to version 6.28.0-root.io.2.
  • Update undici to version 6.28.1-aikido.2.
  • Update rootio @rootio/undici to version 6.28.1-root.io.2.
  • Update undici to version 7.29.1-aikido.2.
  • Update rootio @rootio/undici to version 7.29.1-root.io.2.
  • Update undici to version 7.29.0-aikido.6.
  • Update rootio @rootio/undici to version 7.29.0-root.io.6.
  • Update undici to version 6.26.0-aikido.5.
  • Update rootio @rootio/undici to version 6.26.0-root.io.5.
  • Update undici to version 6.27.0-aikido.6.
  • Update rootio @rootio/undici to version 6.27.0-root.io.6.
  • Update undici undici to version 6.29.1 or later.
Affected software
Ecosystem VendorProductAffected versions
– undici undici < 6.29.1
Debian:12 debian node-undici All versions
Ubuntu:24.04:LTS canonical node-undici All versions
– nodejs undici >= 4.0.0, < 6.29.1
>= 7.0.0, < 7.30.1
>= 8.0.0, < 8.12.2
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Root:npm – undici < 5.29.0-aikido.6
< 5.28.5-aikido.4
< 5.28.4-aikido.6
< 6.28.0-aikido.2
< 6.28.1-aikido.2
< 7.29.1-aikido.2
< 7.29.0-aikido.6
< 6.26.0-aikido.5
< 6.27.0-aikido.6
Fix: upgrade to 5.29.0-aikido.6
Root:npm rootio @rootio/undici < 5.29.0-root.io.6
< 5.28.5-root.io.4
< 5.28.4-root.io.6
< 6.28.0-root.io.2
< 6.28.1-root.io.2
< 7.29.1-root.io.2
< 7.29.0-root.io.6
< 6.26.0-root.io.5
< 6.27.0-root.io.6
Fix: upgrade to 5.29.0-root.io.6
npm – undici >= 4.0.0, < 6.29.1
>= 7.0.0, < 7.30.1
>= 8.0.0, < 8.12.2
Fix: upgrade to 6.29.1
Original advisory text
CVE-2026-109383 in undici - Patched by Root
Root has patched CVE-2026-109383 in the undici package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published3 Nov 2026
Updated3 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-109383 · NVD
CVE-2026-109383 · MITRE
DEBIAN-CVE-2026-109383 · OSV
CVE-2026-109383 · OSV
GHSA-2m5v-pch6-74hx · GHSA
UBUNTU-CVE-2026-109383 · OSV
ROOT-APP-NPM-CVE-2026-109383 · OSV
Track software like this
Free during beta