GHSA-m8rv-5g2x-5cg5: undici fixed in 8.9.0, 7.29.0 and 6.28.0

GHSA-m8rv-5g2x-5cg5 PUBLISHED CVSS 4.199999809265137 MEDIUM

undici vulnerable to CRLF Injection via blob-like body 'type' property

Record from GitHub Advisory Database · Published August 3, 2026

undici is fixed in 8.9.0, 7.29.0 and 6.28.0 (npm)

undici vulnerable to CRLF Injection via blob-like body 'type' property

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
undici	npm	8.9.0, 7.29.0, 6.28.0
langfuse-fips-4	Chainguard	4.4.0-r0
renovate	Wolfi	44.23.3-r1
prism	Chainguard	5.16.0-r2
commercial-gitlab-rails-ee-19.2	Chainguard	19.2.7-r1
code-server	Chainguard	4.130.0-r5
langfuse-3	Chainguard	3.225.0-r3
commercial-gitlab-rails-ee-fips-19.1	Chainguard	19.1.9-r0
pelias-api	Chainguard	7.8.0-r7
commercial-gitlab-rails-ee-19.3	Chainguard	19.3.3-r1
vitess-24	Wolfi	24.0.3-r7, 24.0.2-r10
renovate	Chainguard	44.23.3-r1, 44.11.4-r0

20 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

4.199999809265137

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
chainguard	langfuse-fips-4	0
wolfi	renovate	0

chainguard	prism	0
chainguard	commercial-gitlab-rails-ee-19.2	0
npm	undici
chainguard	code-server	0
chainguard	langfuse-3	0
chainguard	commercial-gitlab-rails-ee-fips-19.1	0
chainguard	pelias-api	0
chainguard	commercial-gitlab-rails-ee-19.3	0
wolfi	vitess-24	0, 0
chainguard	renovate	0, 0
chainguard	pulumi	0
wolfi	code-server	0
chainguard	npm-12	0
chainguard	kibana-8.19	0
wolfi	langfuse-3	0, 0
wolfi	pulumi	0
npm	undici	7.0.0, 8.0.0, 0

…and 14 more

Timeline

Aug 3, 2026 CVE Published
Aug 6, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-m8rv-5g2x-5cg5
vulnetix vdb fixes GHSA-m8rv-5g2x-5cg5

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-m8rv-5g2x-5cg5/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →