undici vulnerabilities

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the 'type' property of hand-rolled blob-like request bodies is not validated. An attacker can inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles optional whitespace around the equals sign in Cache-Control directives. This can cause authenticated user data to be cached and served to other users.

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the retry interceptor can deliver a response whose body length does not match the Content-Length header, potentially leading to response desynchronization, connection hangs, or response corruption.

The setCookie function in undici before versions 6.28.0, 7.29.0, and 8.9.0 does not fully sanitize cookie attributes. Domain values are not checked for semicolons, and unparsed array entries are not sanitized, allowing attacker-influenced input to inject additional attributes like SameSite, HttpOnly, or Secure without the caller's knowledge.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

A vulnerability in the undici library causes the requestTls option to be silently dropped when using ProxyAgent with a SOCKS5 proxy. The HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store instead of user-configured settings.

Undici's cookie parser (parseSetCookie) decodes cookie values, which can lead to HTTP response header injection. Applications that forward parsed cookie values into response headers become vulnerable to attacks such as session fixation or malicious redirects.

A vulnerability in Undici allows incorrect classification of responses as cacheable when Cache-Control headers contain whitespace. This can lead to authenticated user data being served to another user from the cache.

In the undici library, a vulnerability allows Socks5ProxyAgent to reuse a single connection pool across different origins without verifying origin match. This causes cross-origin request routing, credential leakage, and potential HTTPS downgrade to HTTP.

A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.

The undici WebSocket client does not limit the number of message fragments, allowing a malicious server to send many small continuation frames. This causes unbounded memory growth and denial of service (DoS).

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. A malicious server can send an out-of-range value (outside 8-15), causing an unhandled RangeError exception and immediate Node.js process termination.

A vulnerability in the undici library allows a server to send a WebSocket frame with a 64-bit length field containing an extremely large value. The ByteParser overflows internal math, enters an invalid state, and throws a fatal TypeError that terminates the process.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. A malicious WebSocket server can send a small compressed frame (a 'decompression bomb') that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.