E2B 2.60.0 changes API retry rules and patches an undici denial-of-service CVE

E2B has published version 2.60.0 of its e2b package. The main change is to how the client retries control-plane API calls. Requests are retried when the server marks them Should-Retry: true, or when a 429, 502, 503 or 504 response arrives without that header, such as one from a load balancer. Responses marked Should-Retry: false are never retried, and the old method and replayable-operation allowlists have been removed.

Errors that happen after a request has been sent are no longer retried, though connection failures still are. Python sandbox creation now leaves out public-traffic options the caller did not set, so the server applies its own default. Null network responses are normalized to omitted values in both Python and JavaScript, while explicit true and false values stay the same.

The release also bumps undici to ^8.12.2 to address CVE-2026-109869, a high-severity denial-of-service issue caused by an unhandled error on excessive content-encodings. The related advisory is GHSA-xjj6-f33q-929c.

Agents that call E2B control-plane APIs should expect fewer automatic retries once a request has gone out, so timeouts that happen mid-request may need retry logic in the agent itself. Python code that sets public-traffic options should confirm the server default is acceptable wherever those options are left out.

Anyone running the e2b package should move to 2.60.0 to pick up the undici fix for the denial-of-service issue.