Node.js 26.5.1 Bundles Undici 6.26.0 Instead of Documented Version 8.5.0+

[UshaMitra93]

Node.js Version

26.5.1

NPM Version

11.17.0

Operating System

Windows

Subsystem

Other

Description

After upgrading to the latest Node.js version (26.5.1), we expected the bundled Undici dependency to be version 8.5.0 or later, based on the published release information. However, upon verifying the installation, we found that the package.json file located at node_modules\npm\node_modules\undici\package.json still reports the bundled Undici version as 6.26.0.

This behavior appears to be inconsistent with the documented release details. Our expectation was that the npm package bundled with Node.js 26.5.1 would include the updated Undici version. Since the installed package continues to reference version 6.26.0, it is unclear whether the release documentation is incorrect, the npm package has not been updated as expected, or there is another reason for this version mismatch.

Minimal Reproduction

No response

Output

Node.js Module Undici 6.17.x < 6.27.0 / 7.x < 7.28.0 / 8.x < 8.5.0 DoS (CVE-2026-12151)

Before You Submit

• I have looked for issues that already exist before submitting this
• My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask

[avivkeller]

@nodejs/undici

[avivkeller]

Welcome to Node.js v26.5.1.
Type ".help" for more information.
> process.versions.undici
'8.9.0'