Homepage

org.webjars.npm:undici@5.28.4 vulnerabilities

  • latest version

    5.28.4

  • first published

    3 years ago

  • latest version published

    6 months ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:undici package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Insecure Randomness

    org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

    Affected versions of this package are vulnerable to Insecure Randomness due to the use of Math.random(), an insufficiently random value generator, for boundary selection in multipart/form-data requests. An attacker can predict the boundary values and manipulate multipart requests by intercepting and analyzing multiple requests to deduce the random generator pattern.

    Note:

    This is only exploitable if multipart requests are sent to an attacker-controlled server.

    How to fix Insecure Randomness?

    A fix was pushed into the master branch but not yet published.

    [0,)
    Go back to all versions of this package