Skip to content

Version 13.0.0's undici dependency has a CVE out #3337

Closed
Closed
Version 13.0.0's undici dependency has a CVE out#3337
Assignees
legendecas

Description

@zsharpBDO
zsharpBDO
opened on Jul 1, 2026

The released version of node-gyp v13.0.0 uses undici ^6.25.0, which is affected by CVE-2026-11525. PR #3330 brings it to ^8.4.1 (resolves to 8.5.0), which includes a fix for the CVE. Please make a new release with the updated undici version to ensure this package isn't causing dependency issues.

Activity

  1. zsharpBDO
    changed the title [-]Released version of `undici` has a CVE out[/-] [+]Version 13.0.0's `undici` dependency has a CVE out[/+] on Jul 1, 2026

  2. cclauss commented on Jul 1, 2026

    @cclauss
    cclauss
    on Jul 1, 2026
    Contributor
  3. cclauss
    assigned
    legendecas
    on Jul 1, 2026
  4. legendecas
    closed this as completedon Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions