undici
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 55 advisory(ies) without a verdict
Advisories (55)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2gqq-gqf2-x968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor | 7.1.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-2jfj-6hjv-fm6j undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches | 7.0.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent | 4.0.0 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue | < 6.24.0 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse | < 6.27.0 ; 7.0.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-3787-6prv-h9w3 Undici proxy-authorization header not cleared on cross-origin redirect in fetch | < 5.28.3 ; 6.0.0 – < 6.6.1 | Undetermined |
| GHSA-38rv-x7px-6hhq undici WebSocket client vulnerable to denial of service via cumulative fragment bypass | 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-3cvr-822r-rqcc undici before v5.8.0 vulnerable to CRLF injection in request headers | < 5.8.0 | Undetermined |
| GHSA-3g92-w8c5-73pq Undici vulnerable to data leak when using response.arrayBuffer() | 6.14.0 – < 6.19.2 | Undetermined |
| GHSA-3wwx-pv8p-q78v undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression | 6.25.0 – < 6.28.1 ; 7.28.0 – < 7.29.1 ; 8.1.0 – < 8.10.2 | Undetermined |
| GHSA-3xpg-4rpp-hhhm undici vulnerable to Denial of Service via unbounded decompression of compressed responses | 7.15.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-4992-7rv2-5pvq Undici has CRLF Injection in undici via `upgrade` option | < 6.24.0 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives | 7.0.0 – < 7.29.0 ; 8.0.0 – < 8.9.0 | Undetermined |
| GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser | 6.5.0 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor | 7.15.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-5r9g-qh6m-jxff CRLF Injection in Nodejs ‘undici’ via host | 2.0.0 – < 5.19.1 | Undetermined |
| GHSA-8436-99hf-9mmv undici vulnerable to caching and replay of unsafe HTTP method responses | 7.0.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-8qr4-xgw6-wmr3 `undici.request` vulnerable to SSRF using absolute URL on `pathname` | < 5.8.2 | Undetermined |
| GHSA-8xcm-r25x-g524 undici vulnerable to downstream response desynchronization via retry interceptor | < 6.28.0 ; 7.0.0 – < 7.29.0 ; 8.0.0 – < 8.9.0 | Undetermined |
| GHSA-9f24-jqhm-jfcw fetch(url) leads to a memory leak in undici | 6.0.0 – < 6.6.1 | Undetermined |
| GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering | 5.15.0 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-9qxr-qj54-h672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect | < 5.28.4 ; 6.0.0 – < 6.11.1 | Undetermined |
| GHSA-c76h-2ccp-4975 Use of Insufficiently Random Values in undici | 4.5.0 – < 5.28.5 ; 6.0.0 – < 6.21.1 ; 7.0.0 – < 7.2.3 | Undetermined |
| GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data | < 5.29.0 ; 6.0.0 – < 6.21.2 ; 7.0.0 – < 7.5.0 | Undetermined |
| GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client | 6.0.0 – < 6.24.0 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens | 7.15.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-f772-66g8-q5h3 Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type | < 5.8.2 | Undetermined |
| GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching | < 6.27.0 ; 7.0.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-g9mf-h72j-4rw9 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion | 7.0.0 – < 7.18.2 ; < 6.23.0 | Undetermined |
| GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse | 7.23.0 – < 7.28.0 ; 8.0.0 – < 8.2.0 | Undetermined |
| GHSA-jr45-8vmc-qm54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives | 7.0.0 – < 7.29.0 ; 8.0.0 – < 8.9.0 | Undetermined |
| GHSA-m4v8-wqvr-p9f7 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline | < 5.28.4 ; 6.0.0 – < 6.11.1 | Undetermined |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property | < 6.28.0 ; 7.0.0 – < 7.29.0 ; 8.0.0 – < 8.9.0 | Undetermined |
| GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding | < 6.27.0 ; 7.0.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-pgw7-wx7w-2w33 ProxyAgent vulnerable to MITM | 4.8.2 – < 5.5.1 | Undetermined |
| GHSA-phc3-fgpg-7m6h Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS | 7.17.0 – < 7.24.0 | Undetermined |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body | 7.11.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass | 7.0.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-q768-x9m6-m9qp undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect | < 5.8.0 | Undetermined |
| GHSA-qq8j-7v2v-3rwp undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake | 8.11.0 – < 8.11.2 | Undetermined |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | 4.2.1 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
| GHSA-r53p-7pc4-xj5r undici vulnerable to downstream response splitting via retry interceptor | < 6.28.1 ; 7.0.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-r6ch-mqf9-qc9w Regular Expression Denial of Service in Headers | < 5.19.1 | Undetermined |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol | 6.7.0 – < 6.28.1 ; 7.0.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-rx4f-c7p8-82vq undici vulnerable to Denial of Service via WebSocketStream unclean close | 7.0.0 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-v3r7-h72x-cjcm undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields | < 6.28.0 ; 7.0.0 – < 7.29.0 ; 8.0.0 – < 8.9.0 | Undetermined |
| GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation | < 6.24.0 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent | 7.23.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-vp8m-p9jh-q5pm undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors | 8.10.0 – < 8.10.2 | Undetermined |
| GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression | < 6.24.0 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass | < 6.27.0 ; 7.0.0 – < 7.28.0 ; 8.0.0 – < 8.5.0 | Undetermined |
| GHSA-w293-vg96-wgc3 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool | 7.24.1 – < 7.29.1 ; 8.0.0 – < 8.10.2 | Undetermined |
| GHSA-wqq4-5wpv-mx2g Undici's cookie header not cleared on cross-origin redirect in fetch | < 5.26.2 | Undetermined |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | 6.23.0 – < 6.29.1 ; 7.18.0 – < 7.30.1 ; 8.0.0 – < 8.12.2 | Undetermined |
Sources
| Source | Licence |
|---|