org.webjars.npm:undici@7.27.1

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.

Upgrade org.webjars.npm:undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.

Upgrade org.webjars.npm:undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache(). An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed Cache-Control directives such as private="" or mixed private, private="hdr" values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive Set-Cookie data, and mixed qualified/unqualified private directives can raise an uncaught TypeError that aborts the request.

Upgrade org.webjars.npm:undici to version 7.29.0, 8.9.0 or higher.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a Cache-Control header with a qualified private or no-cache directive padded with optional whitespace around =. The parser misreads forms such as private ="" or no-cache= "authorization", so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward Authorization headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.

Upgrade org.webjars.npm:undici to version 7.29.0, 8.9.0 or higher.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Origin Validation Error in the Socks5ProxyAgent. An attacker can intercept or redirect sensitive data, including credentials and request payloads, to unintended origins by exploiting improper verification of origin matching when reusing connection pools. This may also result in responses from incorrect origins being trusted and can lead to silent downgrading of HTTPS requests to HTTP.

Note: This is only exploitable if the application uses Socks5ProxyAgent (directly or via setGlobalDispatcher) and makes requests to more than one origin.

A fix was pushed into the master branch but not yet published.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the Cache-Control header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.

Note: This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.

A fix was pushed into the master branch but not yet published.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

A fix was pushed into the master branch but not yet published.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

A fix was pushed into the master branch but not yet published.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

Upgrade org.webjars.npm:undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

Upgrade org.webjars.npm:undici to version 6.27.0, 7.28.0, 8.5.0 or higher.