Snyk Security Database

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners() on the zlib InflateRaw object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting Z_DATA_ERROR has no listener. This requires the application to use undici's WebSocket client or Node's bundled globalThis.WebSocket against an attacker-controlled or compromised WebSocket server.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the read_block method of TEICorpusView (nltk/corpus/reader/pl196x.py), whose lazy .*? whole-block regexes rescan the text from each opening-tag position. An attacker can force quadratic CPU growth and stall the parser thread by supplying a PL196X or TEI-like corpus file with many unmatched opening tags, so each regex attempt scans to the block end, fails, and restarts from the next tag. This requires the application to parse an attacker-influenced corpus file through the Pl196xCorpusReader public APIs such as words() or tagged_words().

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort() on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default unhandledRejection handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the WebSocketStream API while actively writing through a writer, and the server to be attacker-controlled or compromised.