undici — Vulnerabilities & Security Advisories 30

Undici is a Node.js HTTP/1.1 client library primarily used for making HTTP requests in server-side applications. Historically, it has been vulnerable to several remote code execution (RCE) and cross-site scripting (XSS) flaws, often stemming from improper input validation and insecure default configurations. The library has faced security incidents including path traversal vulnerabilities and request smuggling issues due to inconsistent header handling. While its core functionality is straightforward, undici's security track record shows recurring issues in request parsing and URL handling, requiring careful implementation and regular updates to mitigate risks.