Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-13697: undici library can let attackers run code
CVE-2026-13697 · published 5 days ago
Summary
The undici software used in Node.js environments can be tricked into executing unwanted code. This could let a malicious user take control of the server running the library. Update to the latest undici version that includes the fix as soon as possible.
What to do
- Update GitHub Actions undici to version 7.29.0.
- Update GitHub Actions undici to version 8.9.0.
- Update GitHub Actions undici to version 8.5.0-aikido.1.
- Update rootio @rootio/undici to version 8.5.0-root.io.1.
- Update undici to version 7.25.0-aikido.4.
- Update rootio @rootio/undici to version 7.25.0-root.io.4.
- Update debian node-undici to version 8.9.0+dfsg+~cs3.2.0-1.
- Update undici to version 7.29.0-aikido.1.
- Update rootio @rootio/undici to version 7.29.0-root.io.1.
- Update undici to version 7.29.0-aikido.2.
- Update rootio @rootio/undici to version 7.29.0-root.io.2.
- Update undici undici to version 7.29.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | undici | undici | < 7.29.0 |
| Debian:12 | debian | node-undici | All versions |
| Debian:13 | debian | node-undici | All versions |
| Debian:14 | debian | node-undici |
< 8.9.0+dfsg+~cs3.2.0-1 Fix: upgrade to 8.9.0+dfsg+~cs3.2.0-1
|
| Ubuntu:24.04:LTS | canonical | node-undici | All versions |
| Ubuntu:26.04:LTS | canonical | node-undici | All versions |
| npm | GitHub Actions | undici |
>= 7.0.0, < 7.29.0 >= 8.0.0, < 8.9.0 Fix: upgrade to 7.29.0
|
| – | nodejs | undici |
>= 7.0.0, < 7.29.0 >= 8.0.0, < 8.9.0 cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* |
| Root:npm | GitHub Actions | undici |
< 8.5.0-aikido.1 Fix: upgrade to 8.5.0-aikido.1
|
| Root:npm | rootio | @rootio/undici |
< 8.5.0-root.io.1 < 7.25.0-root.io.4 < 7.29.0-root.io.1 < 7.29.0-root.io.2 Fix: upgrade to 8.5.0-root.io.1
|
| Root:npm | – | undici |
< 7.25.0-aikido.4 < 7.29.0-aikido.1 < 7.29.0-aikido.2 Fix: upgrade to 7.25.0-aikido.4
|
Original advisory text
CVE-2026-13697 in undici - Patched by Root
Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available.
References
- https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272 Mitigation Vendor Advisory
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-13697 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-13697 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-13697 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-13697
- https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451
- https://github.com/nodejs/undici/releases/tag/v7.29.0
- https://github.com/nodejs/undici/releases/tag/v8.9.0
- https://github.com/advisories/GHSA-4cwx-7wf7-3272
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-200Information Exposure
CWE-248Uncaught Exception
CWE-525Use of Web Browser Cache Containing Sensitive Information
Timeline
Published6 Oct 2026
Updated11 Oct 2026
First seen29 Jul 2026
Sources
UBUNTU-CVE-2026-13697 · OSV
CVE-2026-13697 · NVD
CVE-2026-13697 · MITRE
GHSA-4cwx-7wf7-3272 · GHSA
DEBIAN-CVE-2026-13697 · OSV
Track software like this
Free during beta