diff --git a/.changeset/bump-undici8-8-10-0.md b/.changeset/bump-undici8-8-10-0.md
new file mode 100644
index 0000000000..a53c897d2e
--- /dev/null
+++ b/.changeset/bump-undici8-8-10-0.md
@@ -0,0 +1,5 @@
+---
+'e2b': patch
+---
+
+Bump both undici dependencies past the 2026-07-24 security advisories: the required `undici` from `^7.28.0` to `^7.29.0`, and the optional `undici8` (`npm:undici@…`) from 8.8.0 to 8.10.0. Both releases fix one High ([GHSA-4cwx-7wf7-3272](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272)) and four Medium advisories, and undici 8.10.0 additionally fixes HTTP/2 request settling, refused-stream retries and GOAWAY handling, which the SDK exercises because every dispatcher it builds sets `allowH2: true`. Neither bump moves a Node floor — 7.29.0 still requires Node `>=20.18.1` and 8.10.0 still requires `>=22.19.0`, matching the `UNDICI_8_MIN_NODE` gate — so package selection and behaviour are unchanged.
diff --git a/package.json b/package.json
index bf305da6ec..3ad5e09614 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,7 @@
       "minimatch@>=5.0.0 <5.1.8": "^5.1.8",
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
       "minimatch@>=10.0.0 <10.2.3": "^10.2.3",
+      "undici@>=7.0.0 <7.29.0": "^7.29.0",
       "ws@>=8.0.0 <8.20.1": "^8.20.1",
       "shell-quote@<1.9.0": "^1.9.0",
       "sharp@<0.35.0": "^0.35.0",
diff --git a/packages/js-sdk/package.json b/packages/js-sdk/package.json
index 047271a005..c05137fc16 100644
--- a/packages/js-sdk/package.json
+++ b/packages/js-sdk/package.json
@@ -102,10 +102,10 @@
     "openapi-fetch": "^0.14.1",
     "platform": "^1.3.6",
     "tar": "^7.5.19",
-    "undici": "^7.28.0"
+    "undici": "^7.29.0"
   },
   "optionalDependencies": {
-    "undici8": "npm:undici@8.8.0"
+    "undici8": "npm:undici@8.10.0"
   },
   "engines": {
     "node": ">=20.18.1 <21 || >=22"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 3fed247ffd..0af2554765 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,6 +23,7 @@ overrides:
   minimatch@>=5.0.0 <5.1.8: ^5.1.8
   minimatch@>=9.0.0 <9.0.7: ^9.0.7
   minimatch@>=10.0.0 <10.2.3: ^10.2.3
+  undici@>=7.0.0 <7.29.0: ^7.29.0
   ws@>=8.0.0 <8.20.1: ^8.20.1
   shell-quote@<1.9.0: ^1.9.0
   sharp@<0.35.0: ^0.35.0
@@ -167,8 +168,8 @@ importers:
         specifier: ^7.5.19
         version: 7.5.21
       undici:
-        specifier: ^7.28.0
-        version: 7.28.0
+        specifier: ^7.29.0
+        version: 7.29.0
     devDependencies:
       '@cloudflare/vitest-pool-workers':
         specifier: ^0.18.7
@@ -250,8 +251,8 @@ importers:
         version: 4.113.0(@types/node@20.19.43)(bufferutil@4.0.8)(utf-8-validate@6.0.3)
     optionalDependencies:
       undici8:
-        specifier: npm:undici@8.8.0
-        version: undici@8.8.0
+        specifier: npm:undici@8.10.0
+        version: undici@8.10.0
 
   packages/python-sdk: {}
 
@@ -3753,12 +3754,12 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
-  undici@8.8.0:
-    resolution: {integrity: sha512-ubshXMXwF3MQIMF1y/WxZdNBnjEKeSg2wF5mcGUtU55YTw34tnVVpKRlLf7ruDXZ5344KokPVX4RBx1wJm64Bw==}
+  undici@8.10.0:
+    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
     engines: {node: '>=22.19.0'}
 
   unenv@2.0.0-rc.24:
@@ -6424,7 +6425,7 @@ snapshots:
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       sharp: 0.35.3(@types/node@20.19.43)
-      undici: 7.28.0
+      undici: 7.29.0
       workerd: 1.20260721.1
       ws: 8.21.0(bufferutil@4.0.8)(utf-8-validate@6.0.3)
       youch: 4.1.0-beta.10
@@ -7314,9 +7315,9 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
-  undici@8.8.0:
+  undici@8.10.0:
     optional: true
 
   unenv@2.0.0-rc.24: