undici@3.3.1

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Neutralization via unsanitized domain handling and unparsed attribute serialization in lib/web/cookies/util.js. An attacker can inject or override cookie attributes by supplying a crafted domain such as example.com; SameSite=None or an unparsed entry such as X-Custom=val; HttpOnly to setCookie. When applications pass user-controlled tenant or routing data into these fields, the serialized Set-Cookie header can carry attacker-chosen flags like SameSite, Secure, or HttpOnly. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

Upgrade undici to version 6.26.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the upgrade option of the client.request() function. An attacker can inject malicious data into HTTP headers or prematurely terminate HTTP requests by sending specially crafted input, potentially leading to unauthorized information disclosure or bypassing of security controls.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception through improper validation of the server_max_window_bits parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the PerMessageDeflate.decompress() method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling in the processHeader() while handling HTTP/1.1 requests containing duplicate Content-Length headers with differing casing. An attacker can bypass access controls, poison caches, hijack credentials, or cause service disruption by sending specially crafted HTTP requests that are interpreted inconsistently by proxies and backend servers.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the Content-Encoding header.

Upgrade undici to version 6.23.0, 7.18.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper handling of invalid certificate data. An attacker can cause a memory leak by setting up a server with a bad certificate and inducing the application to repeatedly call a webhook-like system.

Upgrade undici to version 5.29.0, 6.21.2, 7.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Authorization due to improper handling of Proxy-Authorization headers during cross-origin redirects in certain methods. An attacker can exploit this behavior by inducing a victim to make a request that triggers a cross-origin redirect, potentially leaking sensitive information contained in the Proxy-Authorization header.

Upgrade undici to version 5.28.4, 6.11.1 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Access Control due to the integrity option passed to fetch(). An attacker can alter this option, allowing fetch() to accept requests as valid even if they have been tampered with.

Upgrade undici to version 5.28.4, 6.11.1 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to not clearing Proxy-Authentication headers on cross-origin redirects. An attacker can intercept the improperly cleared headers.

Upgrade undici to version 5.28.3, 6.6.1 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Information Exposure during the Cookie headers handling process. An attacker can potentially leak sensitive information to a third-party site or a malicious actor who can control the redirection target (i.e., an open redirector) by exploiting the disconnect between the spec's assumptions and the implementation of fetch.

Note:

This is only exploitable if the attacker can control the redirection target.

Upgrade undici to version 5.26.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the Headers.set() and Headers.append() methods, when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Upgrade undici to version 5.19.1 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection due to missing protection for the host HTTP header.

Upgrade undici to version 5.19.1 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection when using unsanitized input as request headers (for example, inside the content-type header).

Upgrade undici to version 5.8.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) when an application takes in unsanitized user input into the path/pathname option of undici.request.

Upgrade undici to version 5.8.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Information Exposure by not clearing cookie headers upon third party redirect.

Note: This is only exploitable when maxRedirections is changed from its default value of 0.

Upgrade undici to version 5.8.0 or higher.