deps: Update dependency undici to ^7.30.0 [SECURITY] - #1809
Merged
Merged
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^7.28.0→^7.30.0undici vulnerable to caching and replay of unsafe HTTP method responses
CVE-2026-85008 / GHSA-8436-99hf-9mmv
More information
Details
Impact
undici's
interceptors.cache()documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (POST,PUT,PATCH,DELETE) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (canCacheResponse) having no method check, a heuristically-cacheable response (for example a404) with an explicitCache-Control: max-age=...to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (methods: ['GET']), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.Patches
Upgrade to
7.29.1or8.10.2. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.Workarounds
None.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
CVE-2026-84961 / GHSA-w293-vg96-wgc3
More information
Details
Impact
undici's
BalancedPoolpasses its constructor options through a JSON-based deep clone (JSON.parse(JSON.stringify(...))) before forwarding them to each per-upstreamPool. JSON cannot represent functions, so a caller-suppliedconnectortlsoption containing acheckServerIdentitycallback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a customcheckServerIdentitywas written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made throughBalancedPool.Client,Pool,Agent, andRoundRobinPooldestructureconnect/tlsbefore the clone and are not affected. Only applications that useBalancedPoolwith a function-valuedconnect/tlsoption (such as a customcheckServerIdentityor connector) are affected.Patches
Upgrade to
7.29.1or8.10.2.BalancedPoolnow preserves theconnectandtlsoptions outside the JSON clone, so custom TLS verification callbacks are forwarded to each upstream unchanged.Workarounds
Use
Client,Pool, orAgentinstead ofBalancedPoolfor connections that rely on a customcheckServerIdentityor connector, until upgraded.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
CVE-2026-84947 / GHSA-2gqq-gqf2-x968
More information
Details
Impact
undici's
interceptors.dump()reads and discards response bodies up to a configurablemaxSize. When a response declares aContent-Lengththat exceedsmaxSize, the request is aborted cleanly. When a response is sent chunked (noContent-Length) and its body exceedsmaxSize, it is not aborted: the interceptor ends the response early once the accumulated size reachesmaxSize, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading200with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.Patches
Upgrade to
7.29.1or8.10.2. The dump interceptor now enforcesmaxSizeon both the declared and the received body size, aborting the request with aRequestAbortedErrorinstead of returning a truncated response.Workarounds
None. Avoid using
interceptors.dump()with untrusted upstreams until upgraded.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
CVE-2026-84933 / GHSA-2jfj-6hjv-fm6j
More information
Details
Impact
undici's
interceptors.cache()does not handleSet-Cookiein the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for exampleCache-Control: public, max-age=...) carrying aSet-Cookieheader is stored, and the storedSet-Cookieis re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (type: 'private') are not affected.Patches
Upgrade to
7.29.1or8.10.2. In shared-cache mode, undici no longer stores or re-serves responses containingSet-Cookie, including previously cached entries and revalidation paths.Workarounds
Use a private cache (
type: 'private') for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should stripSet-Cookiefrom responses before caching.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to downstream response splitting via retry interceptor
CVE-2026-18540 / GHSA-r53p-7pc4-xj5r
More information
Details
Impact
Undici's
interceptors.retry()can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried aContent-Length, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwardedContent-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).For example, a
404 Not FoundwithContent-Length: 2that sends one byte then closes can be resumed with an open-endedRangerequest, and the resumed206 Partial Contentbytes are appended, so the application receives more than two body bytes while still seeingContent-Length: 2. The bug requiresinterceptors.retry()enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculateContent-Length.Patches
Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.
Workarounds
interceptors.retry()for untrusted upstreams, or setmaxRetries: 0.Content-Lengthbefore forwarding a response body assembled by Undici.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-18149 / GHSA-pmjh-fq2x-6v4x
More information
Details
Impact
undici's
RetryHandlercan leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the originalresponse.bodyheld by the application is never settled, so reads such asresponse.body.text()hang andbodyTimeoutdoes not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.Patches
Patched in undici v7.29.1 and v8.10.2.
Workarounds
Impose an independent request deadline and destroy the response body when it expires.
bodyTimeoutalone does not prevent this.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
nodejs/undici (undici)
v7.30.0Compare Source
v7.29.1Compare Source
High severity
BalancedPoolcould drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preservesconnectand legacytlsoptions when creating upstreams. Fixed by f690157d.TypeErrorthat could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.Medium severity
WebSocketStreamclose could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.maxSize. Fixed by 2c7d7e12.Low severity
POSTorDELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.Content-Lengthwas present. Undici now enforcesmaxSizeagainst received bytes and aborts oversized responses. Fixed by 21693f40.Content-Rangeagainst the original response framing before resuming. Fixed by cd8af90b.What's Changed
Full Changelog: nodejs/undici@v7.29.0...v7.29.1
v7.29.0Compare Source
What's Changed
Full Changelog: nodejs/undici@v7.28.0...v7.29.0
Configuration
📅 Schedule: (in timezone Europe/Zurich)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.