Security: Upgrade Undici to v8.9.0 / v7.29.0 / v6.28.0 (5 advisories, 1 high, 4 medium)
Assessment
This issue has not been assessed yet.
Description
Undici has released v8.9.0, v7.29.0, and v6.28.0, fixing five security advisories (one high severity, four medium). Our application uses Undici directly, or uses fetch(), we are using Undici and should upgrade.
High severity
- GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in a shared cache, or crash the parser at parse time. The cache parser now conservatively handles empty and mixed qualified/unqualified directives. Affects v7 and v8.
Medium severity
- GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Affects v7 and v8.
- GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header.
- GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, which can cause response desynchronization, hangs or corruption downstream. Partial responses whose Content-Length is inconsistent with Content-Range are now rejected.
- GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes.
The release also includes a defense-in-depth change: non-string header values are validated after coercion, including array elements, so crafted toString() or Symbol.toPrimitive implementations cannot introduce CRLF sequences.
Upgrade
npm install undici@^8.9.0 # or ^7.29.0, or ^6.28.0
Note: Undici v6 is affected by three of the five advisories; the two cache-interceptor issues are outside its scope.
Action items
- Check which version of Undici this project depends on (directly or transitively)
- Upgrade to the patched version (^8.9.0, ^7.29.0, or ^6.28.0)
- Dominant language
- TypeScript
- Stars
- 36
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sourcefuse/loopback4-ratelimiter
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
sourcefuse/loopback4-ratelimiter#248 · 3 comments ·
All issues in sourcefuse/loopback4-ratelimiter
Similar issues
-
chore v2
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/servers#5115 ·
Maintainers usually reply within 1 day
-
beginner bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 85/100
philaconvalley/website#168 ·
Maintainers usually reply within 1 day
-
bug frontend good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
oss-slu/lrda_mobile#294 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
hatchet-dev/hatchet#5179 ·
Maintainers usually reply within 1 day