undici@8.10.1

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache() and interceptors.deduplicate() interceptors, which build cache and deduplication keys without the actual destination origin when the dispatcher lacks a single authoritative origin or requests supply their own origin. An attacker who controls responses from one origin can have them returned for requests to a different, trusted origin whose method, path, and relevant headers match, enabling cross-origin information disclosure and persistent cache poisoning such as JWKS poisoning. This requires a cache store or interceptor instance shared across multiple origins, together with a dispatcher that has no single authoritative origin or requests that carry their own origin.

Upgrade undici to version 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort() on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default unhandledRejection handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the WebSocketStream API while actively writing through a writer, and the server to be attacker-controlled or compromised.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the interceptors.cache() interceptor, whose skip-list construction subtracts the configured methods from the safe-method set instead of excluding the unsafe methods (POST, PUT, PATCH, DELETE), and whose canCacheResponse storage gate does not validate the method. An attacker can have a fabricated response served for later state-changing requests, which then never reach the origin, by returning from an untrusted origin a heuristically cacheable response such as a 404 that carries an explicit Cache-Control: max-age directive to an unsafe method. This applies under the default cache configuration (methods: ['GET']) and requires the origin to return a heuristically cacheable response bearing an explicit cache-control directive.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parse(JSON.stringify(...)) and thereby silently drops any function-valued callbacks, such as a custom checkServerIdentity or connector, before they reach the TLS layer. An attacker can present a server certificate that the caller's custom checkServerIdentity was written to reject and still have it accepted, as long as it passes Node's default hostname and chain checks, because the discarded check never runs. This affects only BalancedPool configured with function-valued connect or tls options, and not Client, Pool, Agent, or RoundRobinPool.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache() interceptor's shared-cache mode (type: 'shared'), which stores responses without excluding their Set-Cookie headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a Set-Cookie header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable Set-Cookie responses from a multi-user or untrusted upstream, and private caches are unaffected.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump() interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but terminates after reaching maxSize and trips an internal assertion that is caught and converted into a request abort and connection tear-down. An attacker can cause the application to receive a misleading 200 response with a truncated or empty body, followed by a dropped connection, by returning from an upstream a chunked response without Content-Length that exceeds the dump limit. This requires the application to use the interceptors.dump() interceptor against an untrusted or misbehaving upstream.

Upgrade undici to version 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry() interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body, so the delivered body can exceed the declared Content-Length. An attacker can inject bytes beyond the Content-Length into a forwarded response and split the downstream HTTP response by running an upstream that returns a partial response and then resumes it with a Range request, for example a 404 with Content-Length: 2 that sends one byte, closes, then appends 206 Partial Content bytes. This requires the application to enable interceptors.retry(), an untrusted or faulty upstream, and a downstream proxy or gateway that forwards the body without recalculating framing.

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext ws:// where a MitM can alter the handshake.

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress() interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose Content-Encoding expands to gigabytes. This requires the application to use the interceptors.decompress() interceptor against untrusted or compromised upstream servers.

Upgrade undici to version 7.29.1, 8.10.2 or higher.