Uncaught Exceptionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning a response with more than five content-encoding layers triggers an error path that previously called reject() before the response body Readable stream was initialised, leaving the stream in an inconsistent state and crashing the client process.
How to fix Uncaught Exception? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=6.23.0 <6.29.1>=7.18.0 <7.30.1>=8.0.0 <8.12.2 |
Allocation of Resources Without Limits or Throttlingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is only enforced inside parseLine(), which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a data: field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=6.5.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Allocation of Resources Without Limits or Throttlingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=5.15.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Uncaught Exceptionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERR_TLS_CERT_ALTNAME_INVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed assert call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.
How to fix Uncaught Exception? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=4.2.1 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Improper Certificate Validationundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored in kOptions. Because the tls field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.
How to fix Improper Certificate Validation? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=4.0.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
