Snyk Security Database

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via the cache interceptor in lib/interceptor/cache.js when it is composed with a downstream handler that throws during response processing. When a cached response is replayed through the cache interceptor's async store path, a throw raised asynchronously - for example from the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values - escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can trigger this crash by serving a cacheable response whose replayed body or headers cause the downstream handler to throw, including on a 304 revalidation of a stale cache entry.

Note: This is only exploitable when the cache interceptor is composed with a downstream response handler that throws during response processing (such as dump with a maxSize limit, or decompress with more than five Content-Encoding values).

ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy.

Affected versions of this package are vulnerable to Information Exposure via the PRESERVE allow-list in lib/ansible/_internal/_task.py. When a task marked no_log: true fails, the default stdout callback prints its retained exception text, which can include secret argument values, variable-file source snippets, or full fail/assert messages. This exposes sensitive data in terminal output, CI logs, and automation logs.

Notes

• On the exception-generation step, a templating error prints the failing line and the two preceding lines of the variables file, so secrets in nearby lines of a file such as -e @secrets.yml can leak even if they are not the failing value.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the TagList.add() method in CBORParser. An attacker can send a CBOR value preceded by a long run of tags, causing repeated fixed-increment array growth and copying that consumes quadratic CPU and garbage-collection time. Parsing pins request threads, and concurrent requests can exhaust the application’s request pool.

Notes

• Tag accumulation: CBORParser has no configurable cap on stacked tags, so the attacker can send an arbitrarily long tag run; deployments cannot limit this attack through a tag-count setting.