Undici HTTP client advisories flagged across packages
Snyk flags several undici HTTP client advisories, including a crash from malformed WebSocket handshakes, in Backstage packages.
Tier I · Proven The best-established problems.
7 public reports · first reported 18 October 2026 · last reported 22 October 2026
What's going wrong
Maintainers of the Backstage project receive repeated Snyk reports that the undici HTTP client, pulled in through many packages, has known vulnerabilities.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 7 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.