undici@7.3.0

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the interceptors.cache() interceptor, whose skip-list construction subtracts the configured methods from the safe-method set instead of excluding the unsafe methods (POST, PUT, PATCH, DELETE), and whose canCacheResponse storage gate does not validate the method. An attacker can have a fabricated response served for later state-changing requests, which then never reach the origin, by returning from an untrusted origin a heuristically cacheable response such as a 404 that carries an explicit Cache-Control: max-age directive to an unsafe method. This applies under the default cache configuration (methods: ['GET']) and requires the origin to return a heuristically cacheable response bearing an explicit cache-control directive.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache() interceptor's shared-cache mode (type: 'shared'), which stores responses without excluding their Set-Cookie headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a Set-Cookie header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable Set-Cookie responses from a multi-user or untrusted upstream, and private caches are unaffected.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump() interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but terminates after reaching maxSize and trips an internal assertion that is caught and converted into a request abort and connection tear-down. An attacker can cause the application to receive a misleading 200 response with a truncated or empty body, followed by a dropped connection, by returning from an upstream a chunked response without Content-Length that exceeds the dump limit. This requires the application to use the interceptors.dump() interceptor against an untrusted or misbehaving upstream.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry() interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body, so the delivered body can exceed the declared Content-Length. An attacker can inject bytes beyond the Content-Length into a forwarded response and split the downstream HTTP response by running an upstream that returns a partial response and then resumes it with a Range request, for example a 404 with Content-Length: 2 that sends one byte, closes, then appends 206 Partial Content bytes. This requires the application to enable interceptors.retry(), an untrusted or faulty upstream, and a downstream proxy or gateway that forwards the body without recalculating framing.

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext ws:// where a MitM can alter the handshake.

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache(). An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed Cache-Control directives such as private="" or mixed private, private="hdr" values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive Set-Cookie data, and mixed qualified/unqualified private directives can raise an uncaught TypeError that aborts the request.

Upgrade undici to version 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed blob-like body whose .type contains \r\n when an application sends it through request(), stream(), pipeline(), or dispatch() without an explicit content-type header. The vulnerable code copies body.type directly into the outgoing content-type header, so the injected newline sequence is written on the wire and processed by the upstream HTTP/1.1 server. This can corrupt request handling and expose or alter requests sent by the user.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a Cache-Control header with a qualified private or no-cache directive padded with optional whitespace around =. The parser misreads forms such as private ="" or no-cache= "authorization", so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward Authorization headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.

Upgrade undici to version 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry() flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit a body whose length does not match the Content-Length header by sending a partial 206 response with mismatched framing and closing the connection to trigger a retry or resume. This can corrupt downstream HTTP framing, causing client or intermediary hangs and response parsing errors, and can expose users of the forwarding service to broken responses or connection desynchronization.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Neutralization via unsanitized domain handling and unparsed attribute serialization in lib/web/cookies/util.js. An attacker can inject or override cookie attributes by supplying a crafted domain such as example.com; SameSite=None or an unparsed entry such as X-Custom=val; HttpOnly to setCookie. When applications pass user-controlled tenant or routing data into these fields, the serialized Set-Cookie header can carry attacker-chosen flags like SameSite, Secure, or HttpOnly. This can weaken CSRF protections, alter cookie visibility to scripts, or change how the browser sends the cookie.

Upgrade undici to version 6.28.0, 7.29.0, 8.9.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

Upgrade undici to version 6.26.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the Cache-Control header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.

Note: This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.

Upgrade undici to version 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection via the upgrade option of the client.request() function. An attacker can inject malicious data into HTTP headers or prematurely terminate HTTP requests by sending specially crafted input, potentially leading to unauthorized information disclosure or bypassing of security controls.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception through improper validation of the server_max_window_bits parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the PerMessageDeflate.decompress() method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling in the processHeader() while handling HTTP/1.1 requests containing duplicate Content-Length headers with differing casing. An attacker can bypass access controls, poison caches, hijack credentials, or cause service disruption by sending specially crafted HTTP requests that are interpreted inconsistently by proxies and backend servers.

Upgrade undici to version 6.24.0, 7.24.0 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the Content-Encoding header.

Upgrade undici to version 6.23.0, 7.18.2 or higher.