PkgSeer

Vulnerability GHSA-pmjh-fq2x-6v4x

Medium Risk

1 hour ago

undici vulnerable to Denial of Service via orphaned RetryHandler response body

7.11.0 - 7.29.0 and 8.0.0 - 8.10.1

Summary

undici vulnerable to Denial of Service via orphaned RetryHandler response body

Details

Impact

undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.

Patches

Patched in undici v7.29.1 and v8.10.2.

Workarounds

Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

6.7.0 - 6.28.0 and 7.0.0 - 7.29.0 and 8.0.0 - 8.10.1 GHSA-rfgv-xxqx-mfg5

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

7.0.0 - 7.29.0 and 8.0.0 - 8.10.1 GHSA-2jfj-6hjv-fm6j

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

6.25.0 - 6.28.0 and 7.28.0 - 7.29.0 and 8.1.0 - 8.10.1 GHSA-3wwx-pv8p-q78v

undici vulnerable to CRLF Injection via blob-like body 'type' property

0.1.0 - 6.27.0 and 7.0.0 - 7.28.0 and 8.0.0 - 8.8.0 GHSA-m8rv-5g2x-5cg5

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

7.0.0 - 7.28.0 and 8.0.0 - 8.8.0 GHSA-jr45-8vmc-qm54

View all vulnerabilities for these packages

Impacted packages

undici

Timeline

Published

1 hour ago

Fixed (8.10.2)

25 days ago

Fixed (7.29.1)

25 days ago

Last Modified

1 hour ago