Uncaught Exception Affecting undici package, versions >=7.0.0 <7.30.2>=8.0.0 <8.12.4

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via the cache interceptor in lib/interceptor/cache.js when it is composed with a downstream handler that throws during response processing. When a cached response is replayed through the cache interceptor's async store path, a throw raised asynchronously - for example from the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values - escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can trigger this crash by serving a cacheable response whose replayed body or headers cause the downstream handler to throw, including on a 304 revalidation of a stale cache entry.

Note: This is only exploitable when the cache interceptor is composed with a downstream response handler that throws during response processing (such as dump with a maxSize limit, or decompress with more than five Content-Encoding values).

Avoid composing the cache interceptor with a response handler that throws during response processing (such as dump with a maxSize) until upgrading.

• GitHub Commit (>=8.0.0 <8.12.4)
• Maintainer's Advisory