Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-109869: Undici library may let attackers run code
CVE-2026-109869 · published 1 day ago
Summary
The Undici HTTP client used in Node.js applications (including Debian, Canonical, Node.js, and Root.io packages) has a weakness that could allow an attacker to execute code on your server. This can lead to unauthorized actions or data compromise. Install the latest patched version of the Undici package from your vendor’s repository as soon as possible.
What to do
- Update undici to version 6.29.1.
- Update undici to version 7.30.1.
- Update undici to version 8.12.2.
- Update undici to version 7.29.0-aikido.4.
- Update rootio @rootio/undici to version 7.29.0-root.io.4.
- Update undici to version 6.29.0-aikido.2.
- Update rootio @rootio/undici to version 6.29.0-root.io.2.
- Update undici to version 6.28.1-aikido.2.
- Update rootio @rootio/undici to version 6.28.1-root.io.2.
- Update undici to version 7.29.1-aikido.2.
- Update rootio @rootio/undici to version 7.29.1-root.io.2.
- Update undici to version 7.29.0-aikido.6.
- Update rootio @rootio/undici to version 7.29.0-root.io.6.
- Update undici to version 6.26.0-aikido.5.
- Update rootio @rootio/undici to version 6.26.0-root.io.5.
- Update debian node-undici to version 8.12.2+dfsg+~cs3.2.3-1.
- Update undici to version 6.27.0-aikido.6.
- Update rootio @rootio/undici to version 6.27.0-root.io.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | node-undici | All versions |
| Ubuntu:24.04:LTS | canonical | node-undici | All versions |
| – | nodejs | undici |
>= 6.23.0, < 6.29.1 >= 7.18.0, < 7.30.1 >= 8.0.0, < 8.12.2 cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* |
| npm | – | undici |
>= 6.23.0, < 6.29.1 >= 7.18.0, < 7.30.1 >= 8.0.0, < 8.12.2 Fix: upgrade to 6.29.1
|
| Root:npm | – | undici |
< 7.29.0-aikido.4 < 6.29.0-aikido.2 < 6.28.1-aikido.2 < 7.29.1-aikido.2 < 7.29.0-aikido.6 < 6.26.0-aikido.5 < 6.27.0-aikido.6 Fix: upgrade to 7.29.0-aikido.4
|
| Root:npm | rootio | @rootio/undici |
< 7.29.0-root.io.4 < 6.29.0-root.io.2 < 6.28.1-root.io.2 < 7.29.1-root.io.2 < 7.29.0-root.io.6 < 6.26.0-root.io.5 < 6.27.0-root.io.6 Fix: upgrade to 7.29.0-root.io.4
|
| Debian:14 | debian | node-undici |
< 8.12.2+dfsg+~cs3.2.3-1 Fix: upgrade to 8.12.2+dfsg+~cs3.2.3-1
|
Original advisory text
CVE-2026-109869 in undici - Patched by Root
Root has patched CVE-2026-109869 in the undici package for Root:npm. Multiple fixed versions available.
References
- https://security-tracker.debian.org/tracker/CVE-2026-109869 Vendor Advisory
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1098... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109869 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-109869 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109869 Third Party Advisory
- https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429
- https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436
- https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5
- https://github.com/nodejs/undici/releases/tag/v6.29.1
- https://github.com/nodejs/undici/releases/tag/v7.30.1
- https://github.com/nodejs/undici/releases/tag/v8.12.2
- https://github.com/advisories/GHSA-xjj6-f33q-929c
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-248Uncaught Exception
CWE-459Incomplete Cleanup
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-109869 · NVD
DEBIAN-CVE-2026-109869 · OSV
CVE-2026-109869 · OSV
GHSA-xjj6-f33q-929c · GHSA
UBUNTU-CVE-2026-109869 · OSV
Track software like this
Free during beta