Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-84890: undici library may let attackers run code
CVE-2026-84890 · published 6 days ago
Summary
The undici package used in Node.js applications can be exploited to execute malicious code on the server. This risk affects all versions of undici listed, including the Debian and Canonical builds. Install one of the newly released patched versions of undici as soon as possible to remove the threat.
What to do
- Update undici to version 7.29.1.
- Update undici to version 8.10.2.
- Update debian node-undici to version 8.10.2+dfsg+~cs3.2.2-1.
- Update undici to version 8.10.2-aikido.3.
- Update rootio @rootio/undici to version 8.10.2-root.io.3.
- Update undici to version 7.29.1-aikido.1.
- Update rootio @rootio/undici to version 7.29.1-root.io.1.
- Update undici to version 7.29.1-aikido.2.
- Update rootio @rootio/undici to version 7.29.1-root.io.2.
- Update undici undici to version 7.29.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | undici | undici | < 7.29.1 |
| Ubuntu:24.04:LTS | canonical | node-undici | All versions |
| – | nodejs | undici |
>= 7.15.0, < 7.29.1 >= 8.0.0, < 8.10.2 cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* |
| npm | – | undici |
>= 7.15.0, < 7.29.1 >= 8.0.0, < 8.10.2 Fix: upgrade to 7.29.1
|
| Debian:12 | debian | node-undici | All versions |
| Debian:14 | debian | node-undici |
< 8.10.2+dfsg+~cs3.2.2-1 Fix: upgrade to 8.10.2+dfsg+~cs3.2.2-1
|
| Root:npm | – | undici |
< 8.10.2-aikido.3 < 7.29.1-aikido.1 < 7.29.1-aikido.2 Fix: upgrade to 8.10.2-aikido.3
|
| Root:npm | rootio | @rootio/undici |
< 8.10.2-root.io.3 < 7.29.1-root.io.1 < 7.29.1-root.io.2 Fix: upgrade to 8.10.2-root.io.3
|
Original advisory text
CVE-2026-84890 in undici - Patched by Root
Root has patched CVE-2026-84890 in the undici package for Root:npm. Multiple fixed versions available.
References
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84890... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84890 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-84890 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-84890 Third Party Advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm Third Party Advisory
- https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11
- https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- https://github.com/advisories/GHSA-3xpg-4rpp-hhhm
- https://security-tracker.debian.org/tracker/CVE-2026-84890 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published29 Oct 2026
Updated4 Nov 2026
First seen4 Sep 2026
Sources
CVE-2026-84890 · OSV
CVE-2026-84890 · NVD
CVE-2026-84890 · MITRE
GHSA-3xpg-4rpp-hhhm · GHSA
UBUNTU-CVE-2026-84890 · OSV
DEBIAN-CVE-2026-84890 · OSV
Track software like this
Free during beta