Uncaught Exceptionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning a response with more than five content-encoding layers triggers an error path that previously called reject() before the response body Readable stream was initialised, leaving the stream in an inconsistent state and crashing the client process.
How to fix Uncaught Exception? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=6.23.0 <6.29.1>=7.18.0 <7.30.1>=8.0.0 <8.12.2 |
Allocation of Resources Without Limits or Throttlingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is only enforced inside parseLine(), which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a data: field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=6.5.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Uncaught Exceptionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or onResponseEnd propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.
How to fix Uncaught Exception? Upgrade undici to version 7.30.1, 8.12.2 or higher.
| >=7.15.0 <7.30.1>=8.0.0 <8.12.2 |
Allocation of Resources Without Limits or Throttlingundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=5.15.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Uncaught Exceptionundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERR_TLS_CERT_ALTNAME_INVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed assert call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.
How to fix Uncaught Exception? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=4.2.1 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Improper Handling of Case Sensitivityundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch() implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as SHA256-... or Sha256-... is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.
Note: This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., SHA256, Sha384) in its integrity metadata rather than the canonical lowercase forms.
How to fix Improper Handling of Case Sensitivity? Upgrade undici to version 7.30.1, 8.12.2 or higher.
| >=7.15.0 <7.30.1>=8.0.0 <8.12.2 |
Origin Validation Errorundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in CacheHandler.onResponseStart, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive Cache-Control directives (such as no-store or private) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.
Note: This is only exploitable when an originless Agent, a shared MemoryCacheStore or SqliteCacheStore, and the composition compose(redirect(), cache()) are all used.
How to fix Origin Validation Error? Upgrade undici to version 7.30.1, 8.12.2 or higher.
| >=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
Improper Certificate Validationundici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored in kOptions. Because the tls field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.
How to fix Improper Certificate Validation? Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.
| >=4.0.0 <6.29.1>=7.0.0 <7.30.1>=8.0.0 <8.12.2 |
