org.webjars.npm:undici 6.29.0

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:undici package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Time-of-check Time-of-use (TOCTOU) Race Condition org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server. Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? A fix was pushed into the `master` branch but not yet published.	[0,)
H Allocation of Resources Without Limits or Throttling org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server. How to fix Allocation of Resources Without Limits or Throttling? A fix was pushed into the `master` branch but not yet published.	[0,)
M HTTP Request Smuggling org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling in the `processHeader()` while handling HTTP/1.1 requests containing duplicate `Content-Length` headers with differing casing. An attacker can bypass access controls, poison caches, hijack credentials, or cause service disruption by sending specially crafted HTTP requests that are interpreted inconsistently by proxies and backend servers. How to fix HTTP Request Smuggling? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
H Uncaught Exception org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption. How to fix Uncaught Exception? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
H Improper Handling of Highly Compressed Data (Data Amplification) org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the `PerMessageDeflate.decompress()` method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness. How to fix Improper Handling of Highly Compressed Data (Data Amplification)? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
H Uncaught Exception org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception through improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance. How to fix Uncaught Exception? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
M CRLF Injection org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to CRLF Injection via the `upgrade` option of the `client.request()` function. An attacker can inject malicious data into HTTP headers or prematurely terminate HTTP requests by sending specially crafted input, potentially leading to unauthorized information disclosure or bypassing of security controls. How to fix CRLF Injection? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
M Allocation of Resources Without Limits or Throttling org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the `Content-Encoding` header. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.webjars.npm:undici` to version 7.27.1 or higher.	[,7.27.1)
H Insecure Randomness org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Insecure Randomness due to the use of `Math.random()`, an insufficiently random value generator, for boundary selection in multipart/form-data requests. An attacker can predict the boundary values and manipulate multipart requests by intercepting and analyzing multiple requests to deduce the random generator pattern. Note: This is only exploitable if multipart requests are sent to an attacker-controlled server. How to fix Insecure Randomness? Upgrade `org.webjars.npm:undici` to version 7.12.0 or higher.	[,7.12.0)

Vulnerability

Vulnerable Version

Time-of-check Time-of-use (TOCTOU) Race Condition

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

A fix was pushed into the master branch but not yet published.

[0,)

Allocation of Resources Without Limits or Throttling

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

How to fix Allocation of Resources Without Limits or Throttling?

A fix was pushed into the master branch but not yet published.

[0,)

HTTP Request Smuggling

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling in the processHeader() while handling HTTP/1.1 requests containing duplicate Content-Length headers with differing casing. An attacker can bypass access controls, poison caches, hijack credentials, or cause service disruption by sending specially crafted HTTP requests that are interpreted inconsistently by proxies and backend servers.

How to fix HTTP Request Smuggling?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

Uncaught Exception

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.

How to fix Uncaught Exception?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

Improper Handling of Highly Compressed Data (Data Amplification)

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the PerMessageDeflate.decompress() method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.

How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

Uncaught Exception

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception through improper validation of the server_max_window_bits parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.

How to fix Uncaught Exception?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

CRLF Injection

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the upgrade option of the client.request() function. An attacker can inject malicious data into HTTP headers or prematurely terminate HTTP requests by sending specially crafted input, potentially leading to unauthorized information disclosure or bypassing of security controls.

How to fix CRLF Injection?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

Allocation of Resources Without Limits or Throttling

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the Content-Encoding header.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.webjars.npm:undici to version 7.27.1 or higher.

[,7.27.1)

Insecure Randomness

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Insecure Randomness due to the use of Math.random(), an insufficiently random value generator, for boundary selection in multipart/form-data requests. An attacker can predict the boundary values and manipulate multipart requests by intercepting and analyzing multiple requests to deduce the random generator pattern.

Note:

This is only exploitable if multipart requests are sent to an attacker-controlled server.

How to fix Insecure Randomness?

Upgrade org.webjars.npm:undici to version 7.12.0 or higher.

[,7.12.0)

org.webjars.npm:undici@6.29.0

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically