Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

undici library can let attackers run code

CVE-2026-84961 · published 2 days ago
Summary

The undici component used in Node.js applications has a security weakness that could let an attacker execute unwanted code on your server. This affects all undici versions before the recent fixes released by Root. Apply the latest updated version of undici from Root or your package manager without delay.

What to do
  • Update debian node-undici to version 8.10.2+dfsg+~cs3.2.2-1.
  • Update undici to version 7.29.1.
  • Update undici to version 8.10.2.
  • Update undici to version 7.29.0-aikido.1.
  • Update rootio @rootio/undici to version 7.29.0-root.io.1.
  • Update undici to version 7.24.6-aikido.6.
  • Update rootio @rootio/undici to version 7.24.6-root.io.6.
  • Update undici to version 7.28.0-aikido.3.
  • Update rootio @rootio/undici to version 7.28.0-root.io.3.
  • Update undici to version 8.10.0-aikido.2.
  • Update rootio @rootio/undici to version 8.10.0-root.io.2.
  • Update undici to version 7.25.0-aikido.5.
  • Update rootio @rootio/undici to version 7.25.0-root.io.5.
  • Update undici to version 7.25.0-aikido.6.
  • Update rootio @rootio/undici to version 7.25.0-root.io.6.
  • Update undici to version 8.10.2-aikido.3.
  • Update rootio @rootio/undici to version 8.10.2-root.io.3.
  • Update undici to version 7.29.1-aikido.1.
  • Update rootio @rootio/undici to version 7.29.1-root.io.1.
  • Update undici to version 7.29.1-aikido.2.
  • Update rootio @rootio/undici to version 7.29.1-root.io.2.
  • Update undici to version 8.10.2-aikido.4.
  • Update rootio @rootio/undici to version 8.10.2-root.io.4.
  • Update undici undici to version 7.29.1 or later.
Affected software
Ecosystem VendorProductAffected versions
– undici undici < 7.29.1
Ubuntu:24.04:LTS canonical node-undici All versions
– nodejs undici >= 7.24.1, < 7.29.1
>= 8.0.0, < 8.10.2
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Debian:12 debian node-undici All versions
Debian:14 debian node-undici < 8.10.2+dfsg+~cs3.2.2-1
Fix: upgrade to 8.10.2+dfsg+~cs3.2.2-1
npm – undici >= 7.24.1, < 7.29.1
>= 8.0.0, < 8.10.2
Fix: upgrade to 7.29.1
Root:npm – undici < 7.29.0-aikido.1
< 7.24.6-aikido.6
< 7.28.0-aikido.3
< 8.10.0-aikido.2
< 7.25.0-aikido.5
< 7.25.0-aikido.6
< 8.10.2-aikido.3
< 7.29.1-aikido.1
< 7.29.1-aikido.2
< 8.10.2-aikido.4
Fix: upgrade to 7.29.0-aikido.1
Root:npm rootio @rootio/undici < 7.29.0-root.io.1
< 7.24.6-root.io.6
< 7.28.0-root.io.3
< 8.10.0-root.io.2
< 7.25.0-root.io.5
< 7.25.0-root.io.6
< 8.10.2-root.io.3
< 7.29.1-root.io.1
< 7.29.1-root.io.2
< 8.10.2-root.io.4
Fix: upgrade to 7.29.0-root.io.1
Original advisory text
CVE-2026-84961 in undici - Patched by Root
Root has patched CVE-2026-84961 in the undici package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published6 Nov 2026
Updated6 Nov 2026
First seen4 Sep 2026
Sources
CVE-2026-84961 · NVD
CVE-2026-84961 · MITRE
CVE-2026-84961 · OSV
GHSA-w293-vg96-wgc3 · GHSA
UBUNTU-CVE-2026-84961 · OSV
DEBIAN-CVE-2026-84961 · OSV
ROOT-APP-NPM-CVE-2026-84961 · OSV
Track software like this
Free during beta