chore(deps): update dependency undici to v6.24.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	6.18.2 → 6.24.1

---

Release Notes

nodejs/undici (undici)

v6.24.1

Compare Source

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

v6.24.0

Compare Source

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
  CRLF injection via the upgrade option.

• GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
  Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

• GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
  Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

• CVE-2026-1525: affected < 6.24.0, patched 6.24.0
• CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0
• CVE-2026-1527: affected < 6.24.0, patched 6.24.0
• CVE-2026-2229: affected < 6.24.0, patched 6.24.0
• CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

• GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
• NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
• NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
• NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

v6.23.0

Compare Source

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

Compare Source

What's Changed

• fix: fix wrong stream canceled up after cloning (v6) by @​snyamathi in #​4414
• [Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @​github-actions[bot] in #​4432
• feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#​4180) by @​metcoder95 in #​4433
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#​4180) (#​4340) by @​metcoder95 in #​4445
• Backport 4472 to v6.x by @​Uzlopak in #​4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

Compare Source

What's Changed

• [Backport v6.x] append crlf to formdata body by @​github-actions in #​4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

v6.21.2

Compare Source

What's Changed

• fix(types): add missing DNS interceptor by @​slagiewka in #​4024
• [v6.x] fix wpts on windows by @​mcollina in #​4093
• Removed clients with unrecoverable errors from the Pool #​4088

New Contributors

• @​slagiewka made their first contribution in #​4024

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

v6.21.1

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

• fix(#​3736): back-port 183f8e9 to v6.x by @​ggoodman in #​3855
• fix(#​3817): send servername for SNI on TLS (#​3821) [backport] by @​metcoder95 in #​3864
• fix: sending formdata bodies with http2 (#​3863) [backport] by @​metcoder95 in #​3866
• [Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @​github-actions in #​3877
• types: [backport] Update return type of RetryCallback (#​3851) by @​metcoder95 in #​3876

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

v6.21.0

Compare Source

What's Changed

• [Backport v6.x] web: mark as uncloneable when possible (#​3709) by @​jazelly in #​3744
• [Backport v6.x] fetch: fix content-encoding order by @​github-actions in #​3764
• [Backport v6.x] fix: handle undefined deref() of WeakRef(socket) by @​github-actions in #​3822
• [Backport v6.x] fix: range end is zero-indexed by @​github-actions in #​3827

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

v6.20.1

Compare Source

What's Changed

• [Backport v6.x] jsdoc: add jsdoc to lib/web/fetch/constants.js by @​github-actions in #​3710
• [Backport v6.x] feat: implement BodyReadable.bytes by @​github-actions in #​3711
• fix: add more expectsPayload methods by @​ronag in #​3715
• [Backport v6.x] chore(H2): onboard H2 into Undici queueing system (#​3707) by @​Uzlopak in #​3724
• [Backport v6.x] fix: PoolBase kClose and kDestroy should await and not return the Promise by @​github-actions in #​3723
• [Backport v6.x] fix: extract noop everywhere by @​Uzlopak in #​3727

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

v6.20.0

Compare Source

What's Changed

• Remove patched dom types (v6.x branch) by @​eXhumer in #​3531
• docs(Backport v6.x): Fix signature of RetryHandler by @​github-actions in #​3594
• deps(dev): update @​types/node by @​metcoder95 in #​3618
• fix: throw on retry when payload is consume by downstream by @​github-actions in #​3596
• feat(Backport v6.x): move throwOnError to interceptor by @​github-actions in #​3595
• [Backport v6.x] fix: reduce memory usage in client-h1 by @​github-actions in #​3672
• [Backport v6.x] fix: refactor fast timers, fix UND_ERR_CONNECT_TIMEOUT on event loop blocking by @​github-actions in #​3673
• [Backport v6.x] fix: run asserts first if possible by @​github-actions in #​3674
• [Backport v6.x] fix: use fasttimers for all connection timeouts by @​github-actions in #​3675
• [Backport v6.x] ci: less flaky test/request-timeout.js test by @​github-actions in #​3678
• [Backport v6.x] test: less flaky timers acceptance test, rework fast timer tests to pass them faster by @​github-actions in #​3679
• [Backport v6.x] ignore leading and trailing crlfs in formdata body by @​github-actions in #​3681
• [Backport v6.x] mock: fix mocking of Uint8Array and ArrayBuffers as provided mock-responses by @​github-actions in #​3689
• [Backport v6.x] handle body errors by @​Uzlopak in #​3700

Full Changelog: nodejs/undici@v6.19.8...v6.20.0

v6.19.8

Compare Source

Full Changelog: nodejs/undici@v6.19.7...v6.19.8

v6.19.7

Compare Source

Full Changelog: nodejs/undici@v6.19.6...v6.19.7

v6.19.6

Compare Source

Full Changelog: nodejs/undici@v6.19.5...v6.19.6

v6.19.5

Compare Source

Full Changelog: nodejs/undici@v6.19.4...v6.19.5

v6.19.4

Compare Source

Full Changelog: nodejs/undici@v6.19.3...v6.19.4

v6.19.3

Compare Source

Full Changelog: nodejs/undici@v6.19.2...v6.19.3

v6.19.2

Compare Source

What's Changed

• fix #​3337 by @​KhafraDev in #​3338
• build: use husky as husky install is deprecated by @​jazelly in #​3340
• fix: interceptors.d.ts has no default export by @​Uzlopak in #​3332

Full Changelog: nodejs/undici@v6.19.1...v6.19.2

v6.19.1

Compare Source

What's Changed

• don't append empty origin by @​KhafraDev in #​3335

Full Changelog: nodejs/undici@v6.19.0...v6.19.1

v6.19.0

Compare Source

What's Changed

• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @​dependabot in #​3305
• build(deps): bump codecov/codecov-action from 4.3.1 to 4.4.1 by @​dependabot in #​3303
• build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0 by @​dependabot in #​3304
• build(deps): bump github/codeql-action from 3.25.3 to 3.25.7 by @​dependabot in #​3306
• build(deps): bump node from 9e8f45f to dd7e693 in /build by @​dependabot in #​3309
• build(deps): bump node from dd7e693 to e6d4495 in /build by @​dependabot in #​3313
• remove websocket experimental warning by @​KhafraDev in #​3311
• perf: optimization of request instantiation by @​tsctx in #​3107
• perf: convert object to params by @​DarkGL in #​3302
• build(deps-dev): bump borp from 0.14.0 to 0.15.0 by @​dependabot in #​3320
• build(deps-dev): bump c8 from 9.1.0 to 10.0.0 by @​dependabot in #​3321
• fix: add missing error classes to types by @​maxbeatty in #​3316
• export interceptor to type def file by @​jakecastelli in #​3318
• build(deps): bump node from e6d4495 to 075a5cc in /build by @​dependabot in #​3326
• doc: clearify the behaviour of bodyTimeout in the request by @​jakecastelli in #​3324
• feature: support pre-shared sessions by @​tastypackets in #​3325

New Contributors

• @​maxbeatty made their first contribution in #​3316
• @​jakecastelli made their first contribution in #​3318

Full Changelog: nodejs/undici@v6.18.2...v6.19.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.