Repository navigation
Bundled [email protected] is vulnerable to CVE-2026-109383 (fixed in 6.29.1) #10163
Description
Summary
npm 12.2.1 and 11.21.1 bundle [email protected] at node_modules/npm/node_modules/undici. It is a dependency of node-gyp, which requires ^6.25.0. That version is affected by CVE-2026-109383 / GHSA-2m5v-pch6-74hx: Agent drops function-valued tls options such as checkServerIdentity. The fix is in undici 6.29.1, published 2026-10-15.
This is a different CVE from the ones fixed in #10088 / #10089 (bundled undici → 6.29.0), not a duplicate of #10062 / #10111. 6.29.0 is still inside the affected range (>=4.0.0 <6.29.1).
| Line | Branch | Bundled undici | Fixed in |
|---|---|---|---|
| npm 12 | latest (12.2.1) |
6.29.0 | 6.29.1 |
| npm 11 | release/v11 (11.21.1) |
6.29.0 | 6.29.1 |
Impact
Container image scanners (e.g. Cortex/Prisma, Trivy) flag the bundled undici/package.json as a CRITICAL finding (CVSS 9.1). Images that ship npm fail security gates even when Node's own bundled undici is patched. Node 22.23.4 / 24.22.1 / 26.12.1 already ship fixed runtime copies.
Request
Please bump bundled undici to 6.29.1 on latest, and backport it to release/v11. The open release PR #10156 for 12.2.2 does not include it yet.
Reproduce
npm pack [email protected] && tar -xOzf npm-12.2.1.tgz package/node_modules/undici/package.json | grep '"version"'
# "version": "6.29.0"
Activity
Patch npm-bundled brace-expansion and undici until npm 11.21.2 / 12.2…
konard commentedon Oct 30, 2026
Reproduced on Node 26.13.0 / npm 12.2.1 while replacing an unlocked CI scanner install in konard/medical-neural-network-ml#26:
The published npm tarball bundles
[email protected]and also[email protected]. The audit reports GHSA-2m5v-pch6-74hx and other undici advisories fixed in 6.29.1, plus GHSA-rxp7-6hxx-x8q5 (ip-address<=10.7.3, fixed in 10.7.4; current release 10.7.5).The audit says
fixAvailable: true, butnpm audit fixsays both are bundled and cannot be fixed automatically. Nested overrides and a fresh install with those overrides also leave both bundled versions unchanged. No denial-of-service payload was executed.Suggested fix: refresh both bundled dependencies in the npm release, and make the audit's proposed fix distinguish an available reification from a bundled dependency requiring an npm release. We chose pnpm 12.16.1 for the scanner's new frozen lock instead, so we do not add npm's affected bundle to our project dependency tree; its equivalent project audit reports zero vulnerabilities.