# What changed in undici

> 361 changes in undici 6 to 8 from its official release notes, upgrade guides and advisories: 25 breaking, 66 security, 27 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/undici/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## undici 8

### Breaking changes

- Unsupported FormData request bodies are rejected. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- An error is thrown when WebAssembly is unavailable. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Reverts preserving HTTP/2 for legacy fetch consumers. (8.11.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.1)
- Cache reads and writes are now restricted to safe HTTP methods; successful unsafe requests still invalidate cached responses. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-8436-99HF-9MMV)
- Every decompression stage is now limited to 64 MiB by default, and the limit can be configured with maxSize. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-3XPG-4RPP-HHHM)
- maxSize is now enforced against received bytes for chunked responses without Content-Length, and oversized responses are aborted. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-2GQQ-GQF2-X968)
- The connection now fails when an HTTP/2 extended CONNECT response is non-200. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- A server selecting a subprotocol when none was requested now receives protocol error 1002 instead of triggering an uncaught TypeError. (6.28.1, 7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.1), [security advisory](https://github.com/advisories/GHSA-RFGV-XXQX-MFG5)
- Upgrade requests are no longer deduplicated. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- HTTP/2 options are now namespaced, changing how developers configure them. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- The retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, preventing downstream response desynchronization, hangs, or corruption. (6.28.0, 7.29.0, 8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.0), [security advisory](https://github.com/advisories/GHSA-8XCM-R25X-G524)
- setCookie() now validates cookie domains, paths, and unparsed attributes more strictly, preventing injected cookie attributes. (6.28.0, 7.29.0, 8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.0), [security advisory](https://github.com/advisories/GHSA-V3R7-H72X-CJCM)
- Rejects non-ASCII octets in cookie paths. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- A request fails when its CONNECT tunnel drops instead of looping. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Requires exact SameSite values instead of accepting Strict, Lax, or None as substrings, avoiding silently weakened cookie policies. (6.27.0, 7.28.0, 8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.27.0)
- Snapshots are no longer persisted on close in playback mode. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- Removes throwOnError from Dispatcher.RequestOptions. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Requests with malformed content-length headers are now rejected. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Support for non-real Blob objects is removed. (8.0.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.0)
- HTTP/2 is enabled by default, changing the default protocol behavior for developers using Undici. (8.0.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.0)
- Legacy handler wrappers are removed, so code relying on them may need to change. (8.0.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.0)

### Security

- Agent preserves function-valued TLS options when creating per-origin dispatchers, so custom certificate or public-key verification callbacks are not silently dropped. (6.29.1, 7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- The cache interceptor verifies response origin before caching cross-origin redirects and preserves redirect-hop cache-control policy. (7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1)
- The content-encoding chain is validated before creating the body stream, and oversized chains are aborted safely. (6.29.1, 7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- Retained EventSource parser state is bounded, including field counts, buffered chunks, unfinished-line length, and retained field data. (6.29.1, 7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- fetch() normalizes mixed-case and uppercase SRI algorithm tokens before validation and digest selection. (7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1)
- The interceptor limits the size of response error bodies. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- The zstd window size is limited to 8 MB. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Upstream creation now preserves function-valued connect and legacy tls options, including custom TLS certificate validation callbacks. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-W293-VG96-WGC3)
- Cache reads and writes are now restricted to safe HTTP methods, while successful unsafe requests still invalidate cached entries. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [security advisory](https://github.com/advisories/GHSA-8436-99HF-9MMV)
- Proxy-Agent now guards Proxy-Authorization in iterable header containers. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- A terminal retry failure after response headers are exposed now propagates to the exposed body, preventing consumers from hanging indefinitely. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-PMJH-FQ2X-6V4X)
- Fetch now sends Sec-Fetch-Mode only to potentially trustworthy URLs. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- Unbounded recursion in the Set-Cookie attribute parser is avoided. (7.30.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- undici vulnerable to caching and replay of unsafe HTTP method responses (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-8436-99HF-9MMV)
- undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors (8.10.2) — [security advisory](https://github.com/advisories/GHSA-VP8M-P9JH-Q5PM), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-2JFJ-6HJV-FM6J), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1)
- undici vulnerable to Denial of Service via orphaned RetryHandler response body (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-PMJH-FQ2X-6V4X)
- undici vulnerable to Denial of Service via unbounded decompression of compressed responses (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-3XPG-4RPP-HHHM)
- undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression (6.28.1, 7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-3WWX-PV8P-Q78V), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.1)
- undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (6.28.1, 7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-RFGV-XXQX-MFG5)
- undici vulnerable to Denial of Service via WebSocketStream unclean close (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-RX4F-C7P8-82VQ)
- undici vulnerable to downstream response splitting via retry interceptor (6.28.1, 7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-R53P-7PC4-XJ5R), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.1)
- undici vulnerable to response truncation via oversized chunked responses in the dump interceptor (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-2GQQ-GQF2-X968)
- undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool (7.29.1, 8.10.2) — [security advisory](https://github.com/advisories/GHSA-W293-VG96-WGC3)
- A server now rejects a handshake with protocol error 1002 if it selects a subprotocol that was not requested. (6.28.1, 7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [security advisory](https://github.com/advisories/GHSA-RFGV-XXQX-MFG5)
- An unclean close with a locked writable stream now propagates failure through the retained writable stream controller instead of creating an unobserved rejected promise. (7.29.1, 8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [security advisory](https://github.com/advisories/GHSA-RX4F-C7P8-82VQ)
- EventSource event size is limited. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- The cache parser now handles empty qualified directives conservatively and safely handles mixed qualified and unqualified directives, preventing cross-user information disclosure or a parse-time crash. (7.29.0, 8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.0), [security advisory](https://github.com/advisories/GHSA-4CWX-7WF7-3272)
- Cache-Control parsing now normalizes optional whitespace around = in qualified no-cache and private directives and applies conservative cache decisions to prevent shared-cache restrictions from being bypassed. (7.29.0, 8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.0), [security advisory](https://github.com/advisories/GHSA-JR45-8VMC-QM54)
- Non-string header values are validated after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. (8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0)
- undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (6.28.0, 7.29.0, 8.9.0) — [security advisory](https://github.com/advisories/GHSA-V3R7-H72X-CJCM)
- undici vulnerable to CRLF Injection via blob-like body 'type' property (6.28.0, 7.29.0, 8.9.0) — [security advisory](https://github.com/advisories/GHSA-M8RV-5G2X-5CG5), [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.0)
- undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (7.29.0, 8.9.0) — [security advisory](https://github.com/advisories/GHSA-4CWX-7WF7-3272)
- undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (7.29.0, 8.9.0) — [security advisory](https://github.com/advisories/GHSA-JR45-8VMC-QM54)
- undici vulnerable to downstream response desynchronization via retry interceptor (6.28.0, 7.29.0, 8.9.0) — [security advisory](https://github.com/advisories/GHSA-8XCM-R25X-G524)
- Location and Content-Location URIs are invalidated on unsafe methods. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Trims whitespace-padded qualified field names so shared caches do not incorrectly cache authenticated responses as public. (7.28.0, 8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0)
- undici vulnerable to cross-user information disclosure via shared cache whitespace bypass (7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-PR7R-676H-XCF6)
- undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (6.27.0, 7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-P88M-4JFJ-68FV), [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0)
- undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse (6.27.0, 7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-35P6-XMWP-9G52), [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.27.0)
- undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching (6.27.0, 7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-G8M3-5G58-FQ7M)
- undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent (7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-VMH5-MC38-953G), [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0)
- undici WebSocket client vulnerable to denial of service via cumulative fragment bypass (8.5.0) — [security advisory](https://github.com/advisories/GHSA-38RV-X7PX-6HHQ)
- undici WebSocket client vulnerable to denial of service via fragment count bypass (6.27.0, 7.28.0, 8.5.0) — [security advisory](https://github.com/advisories/GHSA-VXPW-J846-P89Q)
- Enforces the configured maximum payload size across all fragments in a message, preventing fragmented messages from exceeding the limit. (8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0)
- Limits the number of fragments in a WebSocket message to prevent unbounded memory growth and denial of service. (7.28.0, 8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0), [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0)
- Rejects pipelined TLS altname errors. (8.4.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.1)
- WebSocket upgrades are now rejected when the response status is not 200. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- SOCKS5 now enforces authenticated state before issuing CONNECT. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Uses per-origin pools to prevent requests, credentials, or responses from being routed across origins. (7.28.0, 8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.28.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse (7.28.0, 8.2.0) — [security advisory](https://github.com/advisories/GHSA-HM92-R4W5-C3MJ)

### New APIs and options

- An alternative experimental HTTP parser is available. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- The MockAgent namespace now exposes the PendingInterceptor and PendingInterceptorsFormatter types. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- HTTP QUERY method support was added. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Adds textStream() to bodyMixin, providing a way to consume the body as a text stream. (8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0)
- The connect option offers HTTP/2 first in ALPN. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- A redirect option was added to strip headers on redirect. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- Adds normalizeBody to SnapshotAgent. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Adds normalizeQuery to SnapshotAgent. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Adds TOpaque to client connect options. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Adds throwOnMaxRedirect to the interceptor options and its types. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Adds configurable maxPayloadSize for WebSocket. (8.1.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.1.0)

### Performance

- Large SQLite cache entries are compressed with zstd. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- The idle-socket timer floor is dropped using a ref'd setImmediate. (6.28.1, 8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Fetch skips work for empty RequestInit objects. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Optimizes the HTTP/2 request hot path. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Caches the FormData boundary. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Reduces redundant scans when selecting a dispatcher. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)

### Behavior and default changes

- DataView reply bodies are now supported. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Mock reply option callbacks can now be asynchronous. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- The Accept-Encoding header used by fetch was updated. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- HTTP/2 delivers an early final response to an Expect: 100-continue request. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Allows HTTP/2 POST requests to be multiplexed. (8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0)
- The HTTP/2 Client now multiplexes requests. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- ProxyAgent now supports proxy authentication using a username without a password. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Built-in fetch mirrors the legacy global dispatcher. (8.0.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1)

### Tooling

- WPT tests are split out of the npm test command. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)

### Fixes and other changes

- Exceptions from downstream response handlers during asynchronous decompression are converted into per-request errors instead of uncaught exceptions. (7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1)
- Post-connect certificate errors no longer terminate the process during HTTP/1.1 and HTTP/2 connection handling. (6.29.1, 7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- Frame parsing pauses when automatic PONG writes encounter backpressure and resumes after the socket drains. (6.29.1, 7.30.1, 8.12.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.2), [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- The build:wasm npm script was restored. (8.12.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.1)
- HTTP/1 handling of 204 and 304 responses is corrected. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Cache event order for 304 responses is preserved when using async stores. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- bodyTimeout is paused while HTTP/2 applies backpressure. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Cached responses now track abort state and preserve abort reasons after completion. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Decompression no longer inflates compress and x-compress encodings. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Numeric expires values outside the Date range are ignored. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- DNS handles a null pick and no longer fails over to an expired record. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- EventSource redirect targets and retry wrapping are corrected, and maxEventSize is enforced on unterminated lines. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Language tags in filename* parameters are parsed. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Connections are reset for transfers with no-body transfer encoding. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- HTTP/2 headers are normalized for legacy dispatch handlers. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- HTTP/2 now enforces the maximum number of concurrent streams. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- MemoryCacheStore evicts least recently used entries. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Removed clients no longer pick up requests. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- A header named __proto__ is preserved across features. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- ProxyAgent handles the Host header correctly. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- WebSocket and EventSource receive limits are retained behind dispatcher wrappers. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Request headers are retained when resuming a download. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- HTTP/1 strictContentLength handling is corrected. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- The throwOnMaxRedirect edge case is corrected, and max-redirect errors now include an error code. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- A bug in TLS session caching is fixed. (7.30.1, 8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Tracked response header field boundaries are preserved. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Cache entries with zero lifetime are always treated as stale. (8.12.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.12.0)
- Aborted requests no longer trigger reconnection. (8.11.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.2)
- Rejected HTTP/2 WebSocket streams are now closed. (7.30.0, 8.11.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.2)
- Fixes a hang when a 3xx response has a large body. (8.11.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.1)
- Fixes bugs in WebSocketStream. (8.11.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.1)
- Pool fan-out is avoided during ALPN negotiation. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Successful cache hits are no longer reported as aborted. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Cache.add no longer hangs. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Cache.addAll no longer hangs. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Repeated content-encoding headers are joined during decompression. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Data URL parsing is improved. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Inherited Object.prototype names are treated as unsupported encodings. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- The decompression interceptor now honors backpressure. (7.30.0, 8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Requests settle when deduplicate is composed with retry. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- An Expires value of 0 is retained when serializing a cookie. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Cookies named __proto__ are retained in getCookies. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- A request is not replayed after GOAWAY if its response has already started. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- The maxConcurrentStreams option is validated directly. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Non-upgrade legacy requests continue to use HTTP/2. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Queued requests remain alive when the last stream closes. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- HTTP/2 response content-length is validated. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Sessions with open streams are no longer unreferenced. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Sessions remain referenced while requests are queued. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Wildcard semantics for NO_PROXY are corrected in EnvHttpProxyAgent. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Repeated iterable headers are preserved by ProxyAgent. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Informational responses are ignored in redirect history. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- Responses settle after a connection closes. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- SIMD is selectively re-enabled for ppc64. (7.30.0, 8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- The compressed flag is reset when a message completes. (8.11.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.11.0)
- The cache now refetches when a 304 response adds Vary fields. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- Last-Event-ID is now validated on EventSource reconnect. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- SOCKS5 connections now honor the configured connection timeout. (8.10.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.2)
- The retry backoff now honors the abort signal. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Pools with pending GOAWAY replays are preserved. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Cache entries are evicted when a key holds a single entry. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Dispatcher origin is propagated to composed interceptors. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- A deduplicated request settles when it is aborted. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Dispatcher options are propagated to the base class. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- HTTP/2 now honors maxResponseSize. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- The dump interceptor rejects aborted requests even when the response is smaller than maxSize. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Persistent mocks re-invoke the reply callback, and MockAgent interceptors are preserved when using legacy global fetch. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Trailing dots are ignored when matching no_proxy. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Interceptor handlers now forward onBodySent and onRequestSent. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- HTTP/2 forwards 1xx informational responses to onInfo. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- The default retry strategy now honors the retryAfter option. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- Negative Max-Age attributes are accepted when processing Set-Cookie. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- The socket is destroyed when SOCKS5 negotiation times out. (8.10.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.1)
- cache() and deduplicate() no longer remain silently inert on Client or Pool instances without opts.origin. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Preserves the DNS origin hostname on sockets. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Ensures every HTTP/2 request settles. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Retries refused HTTP/2 streams. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Detaches the upgrade close handler after GOAWAY. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Uses setTimeout(0) again to prevent stalls on an idle event loop. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Non-string path matchers work with ignoreTrailingSlash. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Emits request body lifecycle hooks. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Bare IPv6 addresses in no_proxy are now matched. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Consumes a body even when its end event has already been emitted. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Preserves body bytes that arrive after setEncoding() is called. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Skips the content-length checkpoint for HEAD requests and 206 responses without content-range. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Forwards informational responses. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Evicts unused origin pools. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- WebSocket now supports process.unref. (8.10.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.10.0)
- Decompression now preserves response trailers. (8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0)
- setGlobalDispatcher now handles a frozen globalThis. (8.9.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.9.0)
- Revalidation-only responses are stored so ETag revalidation can engage. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Decompression is skipped for HEAD responses. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Aborted streams are destroyed synchronously rather than via setImmediate. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Completed requests are released from the queue. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Request streams are completed on end instead of waiting for close. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Stream-bodied requests can now multiplex on a busy HTTP/2 session. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- must-revalidate and proxy-revalidate now take precedence over max-stale and stale-if-error. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Body headers are removed when a redirect changes POST to GET. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- A null init argument is now converted correctly. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- A zero-delay Retry-After value is now handled correctly. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- stale-if-error is honored for connection errors during revalidation. (8.8.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.8.0)
- Guards against a response event delivered after completion. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Destroys the stream on abort rather than relying on close(). (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Automatically detects HTTP proxy tunneling. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Open-ended Range values are no longer rejected. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Ignores chunks that arrive after consumption has completed. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Adds the static buildDispatch method to the RedirectHandler type definition. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Ignores an unparseable Expires attribute. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- Sets the use-URL-credentials flag for EventSource. (8.7.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0)
- The types for deleteCookie attributes were corrected. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Requeues requests on a GOAWAY'd session instead of crashing. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.7.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Response chunks are dropped after the response stream is destroyed. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Retry flow control stays wired to the active connection across resumes. (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Incomplete multi-byte UTF-8 sequences are handled in setEncoding(). (8.6.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0)
- Aligns EventSource behavior with the specification. (8.5.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.5.0)
- Skips DNS requests that do not have an origin. (8.4.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.1)
- Prevents a race condition between onEnd and onTrailers in the HTTP/2 client. (8.4.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.1)
- The paused parser completes on socket end instead of crashing. (8.4.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.6.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.1)
- All synchronous HTTP/2 request stream errors are handled. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- Timeout errors are preserved for HTTP/2 requests. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- Invalid HTTP/2 sessions are reset. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- The method's single-argument behavior is restored. (8.4.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.4.0)
- Validates EOF for chunked HTTP/1 responses. (6.26.0, 7.26.0, 8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.26.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.26.0), [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Accepts Content-Range values with an unknown size. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Aligns HTTP/2 empty-body content-length methods with HTTP/1 behavior. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Preserves a fetch multipart body when falling back to MockAgent. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Prevents replaying the pipeline body on redirect. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Preserves pool capacity after a stale client is removed, preventing the pool from losing capacity. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Validates the response body length against Content-Range. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Uses the configured connector in Socks5ProxyAgent. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Preserves the dispatch backpressure return value. (8.3.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.3.0)
- Prevents the dispatcher from being cleaned up prematurely. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The cache key now includes the query when opts.path is undefined. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Corrects the signed integer bounds used when converting values. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Multipart form-data now prefers filename* over filename. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The AND operator now intersects filterCalls results as expected. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- HTTP/2 now allows request bodies for GET and HEAD requests. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Validates the maxConcurrentStreams option. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Request option validation now rejects NaN highWaterMark values. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The client now respects the peer's maximum number of concurrent streams. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Handles invalid HTTP/2 connection headers. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- HTTP/2 now sends bodies for methods that do not expect payloads when content is supplied. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Accepted streams are preserved after GOAWAY. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Upgrade streams that close before response headers are now rejected. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The TLS session cache now enforces the configured maximum number of cached sessions. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Streamed cache entries at the maxEntrySize limit are now allowed. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Corrects the CRLF check in the multipart form-data parser. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Replaces stale pool clients while remaining under the connection limit. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Stops buffering data after the SOCKS5 connection is established. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Correctly expands the compressed :: notation in IPv6 addresses. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Embedded IPv4 tails in IPv6 literals are now encoded correctly. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Vary information is now persisted when SQLite cache entries are updated. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Expired SQLite vary entries are skipped during lookup. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The SQLite cache now enforces maxCount after inserting an entry. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Pruning now evicts the oldest cache entries first. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- The cache now returns staleAt as an immutable value in milliseconds. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Fixes how the environment variable controls WASM SIMD behavior. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Propagates useH2c to the connector when a pool has more than one connection. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Corrects the argument order when a WebSocketStream encounters a UTF-8 failure. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Avoids double-closing stream readers when a WebSocket stream is canceled. (8.2.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.2.0)
- Prevents cache deduplication key collisions caused by unescaped delimiters. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Preserves the connect option in H2CClient. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Fixes native WebSocket over an H2 server after importing undici. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Throws a descriptive error when opts.dispatcher is passed instance methods. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Removes stale constructor interceptors from the types and pool options. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Makes ProxyAgent respect connectTimeout. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- Avoids 401 failures for requests with stream-backed bodies. (8.0.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.3)
- WebSocket connections fall back to HTTP/1.1 when H2 CONNECT is unavailable. (8.0.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.2)
- Only parsed messages are enqueued in WebSocketStream. (8.0.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1)
- Short-lived cache entries are preserved for revalidation. (8.0.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.0)
- Request statusText is preserved. (8.0.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.1), [release notes](https://github.com/nodejs/undici/releases/tag/v8.0.0)

## undici 7

### Breaking changes

- Removes maxDecompressedMessageSize. (7.24.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.2)
- Non-safe methods are no longer deduplicated by default. (7.22.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.22.0)
- Streams are errored instead of canceled. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- Receiving a 401 now returns the response instead of a network error. (7.19.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.2)

### Security

- Checks Authorization on request headers according to RFC 9111 §3.5. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- Avoids prototype collisions when parsing headers. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- Fixed __proto__ pollution. (7.24.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.1)
- Fixes inconsistent interpretation of HTTP requests that could enable request/response smuggling. (6.24.0, 7.24.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.24.0)
- Undici has an HTTP Request/Response Smuggling issue (6.24.0, 7.24.0) — [security advisory](https://github.com/advisories/GHSA-2MJP-6Q6P-2QXM)
- Undici has CRLF Injection in undici via `upgrade` option (6.24.0, 7.24.0) — [security advisory](https://github.com/advisories/GHSA-4992-7RV2-5PVQ), [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.24.0)
- Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS (7.24.0) — [security advisory](https://github.com/advisories/GHSA-PHC3-FGPG-7M6H), [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0)
- Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (6.24.0, 7.24.0) — [security advisory](https://github.com/advisories/GHSA-VRM6-8VPV-QV8Q), [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.24.0)
- Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (6.24.0, 7.24.0) — [security advisory](https://github.com/advisories/GHSA-V9P9-HFJ2-HCW8), [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.24.0)
- Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (6.24.0, 7.24.0) — [security advisory](https://github.com/advisories/GHSA-F269-VFMQ-VJVJ), [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.0), [release notes](https://github.com/nodejs/undici/releases/tag/v6.24.0)
- Hardens header iterable checks against prototype-pollution scenarios. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Fixes the vulnerability identified as CVE-2026-22036. (6.23.0, 7.18.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.23.0), [security advisory](https://github.com/advisories/GHSA-G9MF-H72J-4RW9)
- Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion (6.23.0, 7.18.2) — [security advisory](https://github.com/advisories/GHSA-G9MF-H72J-4RW9), [release notes](https://github.com/nodejs/undici/releases/tag/v7.18.2)

### New APIs and options

- Adds IP prioritization hints for HTTP/1.1 and HTTP/2. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Adds SOCKS5 proxy support to ProxyAgent. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Revalidation supports asynchronous cache stores. (7.22.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.22.0)
- Adds pingInterval for dispatching PING frames. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- The WebSocketStream interface now includes a close method. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- request() ResponseData now exposes statusText. (7.20.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.20.0)
- Adds an origins option for whitelist filtering. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- Client exposes HTTP/2 flow-control options. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- Adds getUpstream() to retrieve an upstream from a BalancedPool. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds an interceptor for request deduplication. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds storage support for the DNS interceptor. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds support for h2c over Unix domain sockets. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds a round-robin pool. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds runtime feature detection, allowing Undici to detect runtime capabilities. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds a ProxyAgent diagnostics event named undici:proxy:connected. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds support for WebSocket connections through HTTP/2. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)

### Performance

- The EventSourceStream parser now performs fewer allocations. (6.28.1, 7.29.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1), [release notes](https://github.com/nodejs/undici/releases/tag/v6.28.1)
- Uses fewer promises when extracting a body. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)

### Behavior and default changes

- Supports open diagnostics over HTTP/2. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)

### Fixes and other changes

- Lifecycle fixes were backported for upgrade diagnostics. (7.30.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.30.0)
- HTTP/2 now honors headersTimeout, so the configured timeout applies to HTTP/2 requests. (7.29.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1)
- HTTP/2 now handles GOAWAY for CONNECT streams. (7.29.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1)
- HTTP/2 requests whose streams are cancelled are now settled. (7.29.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.29.1)
- v7 now uses the legacy global dispatcher. (7.27.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.27.2)
- Preserves raw headers in the dispatch handler bridge. (7.27.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.27.1)
- Adds support for Node 26 and the legacy global dispatcher. (7.27.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.27.0)
- Fixes handling of stream-backed bodies for 401 responses. (7.24.8) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.8)
- The clone method is now declared as an instance method rather than an instance property. (7.24.7) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.7)
- Fetch now correctly handles multi-value rawHeaders. (7.24.7) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.7)
- Response types now align with DOM fetch types. (7.24.7) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.7)
- Prevents a client hang by wrapping the kConnector call in try/catch. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- Supports connection-specific header names specified by the Connection header, per RFC 7230. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- Improves the error message when mock intercepts are exhausted, making failures easier to diagnose. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- Assumes an HTTP or HTTPS scheme for proxy environment variable values that omit a scheme. (7.24.6) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.6)
- The cache applies a 1-year deleteAt only for immutable responses. (7.24.5) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.5)
- Fixed dispatch path extraction to handle URL credentials. (7.24.4) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.4)
- Fixes a TypeError caused by reading push from null in HTTP/2. (7.24.3) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.3)
- Fixes fetch path logic. (7.24.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.24.2)
- Stops fetch from stripping a trailing ? from a URL. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Fixes a TypeError reading servername in _resume when an HTTP/2 stream completes. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Ignores late data frames after request completion. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Preserves latin1 header encoding in WrapHandler. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Forwards onResponseStarted through WrapHandler and UnwrapHandler. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Prevents AbortController garbage collection when redirect is set to error. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Passes socketPath to custom connect callbacks. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Preserves tuple headers in the DNS interceptor. (7.23.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.23.0)
- Uses the OR operator in includesCredentials to follow the WHATWG URL Standard. (7.22.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.22.0)
- Leading dots and asterisks are stripped when processing proxy exclusions. (7.22.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.22.0)
- WebSocket upgrades are routed through onRequestUpgrade. (7.22.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.22.0)
- Fixes a cleanup race involving clientTtl in Agent. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- The finalizer is now set only for fetch responses. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- Handles an undefined __filename in bundled environments. (7.21.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.21.0)
- Fetch stack traces are preserved. (7.20.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.20.0)
- Fixes delayed responses with AbortSignal in MockAgent. (7.20.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.20.0)
- Fixes flaky stream end handling on macOS. (7.19.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.2)
- HTTP headers are decoded as latin1 instead of utf8. (7.19.2) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.2)
- Fixes a 401 loop in fetch. (7.19.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.1)
- Regenerates a stream from its source when cache.match is called after garbage collection. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- MockAgent normalizes origins for case-insensitivity and URL handling. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- RetryAgent now handles FormData body types correctly for retried requests. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- Fixes basic authentication for WebSocket connections. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- Fixes the WebSocketStream open error. (7.19.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.19.0)
- Fixes running without SSL, which may affect environments where SSL is unavailable. (7.18.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.18.1)
- Fixes an off-by-one error when fetching a Blob with a range. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Updates the cache when a 304 Not Modified response is received upon revalidation. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Handles invalid fetch priority values properly. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Ensures HTTP/2 sends Content-Length for empty POST requests. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Adds a missing return after a callback call in ProxyAgent. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Makes the status parameter optional in the Response.redirect type. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)
- Prevents onSocketClose from being called multiple times. (7.17.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v7.17.0)

## undici 6

### Security

- Cookie values are no longer percent-decoded, preventing encoded CR, LF, or NUL sequences from becoming literal bytes that could enable HTTP header injection. (6.27.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.27.0)
- WebSocket message handling now limits fragment count as well as cumulative payload size, preventing unbounded memory growth and denial of service from malicious servers. (6.27.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.27.0)

### Fixes and other changes

- Fixes aborting Streams. (6.29.1) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.1)
- The exposed body is settled when retry reaches terminal failure. (6.29.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.0)
- Upgrade diagnostics lifecycle fixes were backported to v6.x. (6.29.0) — [release notes](https://github.com/nodejs/undici/releases/tag/v6.29.0)