pkg-pr-new 0.0.93 bundles undici 6.25.0 (via @actions/core) and zod 4.3.6, 16 advisories not visible to npm audit

Aperta Adatta ai principianti
  • Qualcosa non va?
#568 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
build-system, security

Direzione di ricerca

Inizia da pnpm-lock.yaml e tsup.config.ts; l’issue identifica i percorsi @actions/http-client e query-registry come quelli che includono i pacchetti vulnerabili nel bundle. Verifica che il lockfile risolva undici alla versione 6.29.1 o successiva e zod alla versione 4.6.6 o successiva, oppure determina se undici può essere contrassegnato come esterno. Ricrea la build e ispeziona dist/index.js per confermare che le versioni incluse nel bundle siano aggiornate o che undici non sia più incluso.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

While scanning published npm packages for bundled third-party code we found that dist/index.js in [email protected] (npm latest) bundles undici 6.25.0 and zod 4.3.6. undici comes in through @actions/core 3.0.1 → @actions/http-client 4.0.1, which #448 introduced to fix the undici 5.x report in #447. zod comes in through query-registry 4.3.0. pnpm-lock.yaml on main still resolves both versions. Since #448, these advisories were published for them:

  • undici 6.25.0
    • CVE-2026-11525 (GHSA-g8m3-5g58-fq7m): Set-Cookie SameSite downgrade via substring matching (fixed 6.27.0)
    • CVE-2026-12151 (GHSA-vxpw-j846-p89q): WebSocket client DoS via fragment count bypass (fixed 6.27.0)
    • CVE-2026-6733 (GHSA-35p6-xmwp-9g52): response queue poisoning via keep-alive socket reuse (fixed 6.27.0)
    • CVE-2026-9679 (GHSA-p88m-4jfj-68fv): header injection via Set-Cookie percent-decoding (fixed 6.27.0; the range covers 6.25.0, although this copy's parseSetCookie does not percent-decode)
    • CVE-2026-15157 (GHSA-m8rv-5g2x-5cg5): CRLF injection via a blob-like body type (fixed 6.28.0)
    • CVE-2026-16728 (GHSA-8xcm-r25x-g524): response desynchronization via the retry interceptor (fixed 6.28.0)
    • CVE-2026-16729 (GHSA-v3r7-h72x-cjcm): cookie attribute injection via unsanitized domain (fixed 6.28.0)
    • CVE-2026-18540 (GHSA-r53p-7pc4-xj5r): response splitting via the retry interceptor (fixed 6.28.1)
    • CVE-2026-19534 (GHSA-rfgv-xxqx-mfg5): DoS via an unrequested WebSocket subprotocol (fixed 6.28.1)
    • CVE-2026-85024 (GHSA-3wwx-pv8p-q78v): DoS via an unhandled permessage-deflate error (fixed 6.28.1)
    • CVE-2026-109383 (GHSA-2m5v-pch6-74hx): TLS certificate validation bypass via dropped tls options in Agent (fixed 6.29.1)
    • CVE-2026-87018 (GHSA-qrxm-fqhp-jwvm): DoS via TLS 1.2 certificate-changing renegotiation (fixed 6.29.1)
    • CVE-2026-109932 (GHSA-9fm3-97px-rjf6): WebSocket DoS via unbounded automatic PONG buffering (fixed 6.29.1)
    • CVE-2026-109869 (GHSA-xjj6-f33q-929c): DoS via an unhandled error on excessive content-encodings (fixed 6.29.1)
    • CVE-2026-109924 (GHSA-4qv8-2p9j-2685): unbounded memory in the EventSource parser (fixed 6.29.1)
  • zod 4.3.6
    • CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5): memory exhaustion while validating oversized constrained collections (fixed 4.6.6)

The published package.json declares no dependencies, so npm audit and SCA tools cannot flag these copies for you or for users of the CLI.

We did not find a way for them to lead to an exploit in pkg-pr-new:

  • The bundled undici is evaluated but never used: import_undici is never dereferenced, and the CLI's own requests go through Node's global fetch.
  • The zod schemas in query-registry / zod-package-json have no array, set or record size constraints.

SECURITY.md asks for private reports, but given the above we are opening a regular issue, as with #447. Because the copies ship where dependency audits cannot see them, they are easy to miss. We would suggest updating when convenient.

Suggested fix: refresh pnpm-lock.yaml so that @actions/http-client resolves undici >= 6.29.1 and query-registry resolves zod >= 4.6.6 (or add pnpm.overrides), then rebuild and publish. Alternatively, mark undici external in tsup.config.ts, since the CLI does not use it.

Reproduction

Checked against the published tarball on 2026-11-05 (npm latest):

npm pack [email protected]
mkdir p && tar xzf pkg-pr-new-0.0.93.tgz -C p
grep -o '\.pnpm/undici@[0-9.]*\|\.pnpm/zod@[0-9.]*\|\.pnpm/@actions+http-client@[0-9.]*' p/package/dist/index.js | sort | uniq -c
grep -n 'require_undici()' p/package/dist/index.js
grep -c 'import_undici\.' p/package/dist/index.js
grep -c 'maxEventSize' p/package/dist/index.js
node -p "require('./p/package/package.json').dependencies"

Output:

   1 .pnpm/@[email protected]
 192 .pnpm/[email protected]
  17 .pnpm/[email protected]
31810:var import_undici = __toESM(require_undici(), 1);
0
0
undefined

maxEventSize, which undici 6.29.1 adds to the EventSource parser, is absent from the bundle.

Lingua principale
TypeScript
Stelle
1.9k
Fork
131
Merge medio
1g 7h
PR unite (30g)
8

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stackblitz-labs/pkg.pr.new

Tutte le issue di stackblitz-labs/pkg.pr.new

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.