Information Exposureundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache(). An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed Cache-Control directives such as private="" or mixed private, private="hdr" values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive Set-Cookie data, and mixed qualified/unqualified private directives can raise an uncaught TypeError that aborts the request.
How to fix Information Exposure? Upgrade undici to version 7.29.0, 8.9.0 or higher.
| >=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
CRLF Injectionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.
How to fix CRLF Injection? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
Interpretation Conflictundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a Cache-Control header with a qualified private or no-cache directive padded with optional whitespace around =. The parser misreads forms such as private ="" or no-cache= "authorization", so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward Authorization headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.
How to fix Interpretation Conflict? Upgrade undici to version 7.29.0, 8.9.0 or higher.
| >=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
HTTP Request Smugglingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.
How to fix HTTP Request Smuggling? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
Improper Neutralizationundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Improper Neutralization via unsanitized domain handling and unparsed attribute serialization in lib/web/cookies/util.js. An attacker can inject or override cookie attributes by supplying a crafted domain such as example.com; SameSite=None or an unparsed entry such as X-Custom=val; HttpOnly to setCookie. When applications pass user-controlled tenant or routing data into these fields, the serialized Set-Cookie header can carry attacker-chosen flags like SameSite, Secure, or HttpOnly. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie.
How to fix Improper Neutralization? Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.
| <6.28.0>=7.0.0 <7.29.0>=8.0.0 <8.9.0 |
