Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/undici
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v7.18.1
Choose a base ref
...
head repository: nodejs/undici
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v7.18.2
Choose a head ref
  • 2 commits
  • 3 files changed
  • 3 contributors

Commits on Jan 6, 2026

  1. fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… 

    …e exhaustion (#4729)

A malicious server could send responses with thousands of Content-Encoding
layers, causing high CPU usage and memory allocation when creating decompressors.

This fix limits the number of content-encodings to 5, matching the approach
used by urllib3 (GHSA-gm62-xv2j-4w53), curl (CVE-2022-32206), and the recent
fix in lib/web/fetch/index.js.

Fixes CWE-770: Allocation of Resources Without Limits or Throttling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Matteo Collina <[email protected]>
Co-authored-by: Claude Opus 4.5 <[email protected]>
    @mcollina @claude
    mcollina and claude authored Jan 6, 2026
    Configuration menu
    Copy the full SHA
    b04e3cb View commit details
    Browse the repository at this point in the history

  2. Bumped v7.18.2 (#4730) 

    Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
    @github-actions
    github-actions[bot] authored Jan 6, 2026
    Configuration menu
    Copy the full SHA
    7e5cb2d View commit details
    Browse the repository at this point in the history
Loading