undici vulnerabilities

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. When a downstream handler throws asynchronously from a zlib callback, it escapes as an uncaught exception that terminates the Node.js process. A malicious HTTP server can send a small compressed body that decompresses to more than the configured limit, crashing the client.

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.

undici, an HTTP client library for Node.js, in versions 6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1 crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects the response due to a content-encoding limit, but the internal response stream was created before that check without an error listener or request abort, so the early close surfaces an unhandled error and terminates the process.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

undici in versions 7.0.0-7.30.0 and 8.0.0-8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, builds the cache key from the original request URL before the redirect handler changes the origin. A response produced after a cross-origin redirect is stored under the original key, allowing persistent cache poisoning and disclosure of private data to a later unauthenticated caller.

undici in versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1 passes Agent constructor options through a JSON-based deep clone before forwarding them to each per-origin pool. Because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped, so a TLS peer whose certificate the custom callback was written to reject but which passes Node's default checks is silently accepted.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A null dereference causes an uncaught TypeError that terminates the process.

In the undici library before version 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2, the retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This can cause the response body to be longer than the Content-Length observed by the application. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, enabling response splitting or desynchronization.

In the undici library versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2, the retry handler can leave an already-exposed response body pending forever. When a server returns a response with Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards the new response but the original response body is never ended or destroyed, causing reads on that body to never settle and the body timeout not to fire.

undici 8.10.0 omits the destination origin from cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. This allows cross-origin information disclosure and persistent cache poisoning. Affects versions 8.10.0 to 8.10.2; applications using an Agent are not affected.

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash.

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool.

The dump interceptor in undici mishandles chunked responses without Content-Length when the body size exceeds the maximum limit. Instead of pausing or aborting, it signals early completion, causing a second completion signal that triggers an internal assertion and tears down the connection. The application observes a misleading success status with an empty or truncated body while the connection is actually disconnected.

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the 'type' property of hand-rolled blob-like request bodies is not validated. An attacker can inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles optional whitespace around the equals sign in Cache-Control directives. This can cause authenticated user data to be cached and served to other users.

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the retry interceptor can deliver a response whose body length does not match the Content-Length header, potentially leading to response desynchronization, connection hangs, or response corruption.

The setCookie function in undici before versions 6.28.0, 7.29.0, and 8.9.0 does not fully sanitize cookie attributes. Domain values are not checked for semicolons, and unparsed array entries are not sanitized, allowing attacker-influenced input to inject additional attributes like SameSite, HttpOnly, or Secure without the caller's knowledge.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

A vulnerability in the undici library causes the requestTls option to be silently dropped when using ProxyAgent with a SOCKS5 proxy. The HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store instead of user-configured settings.

Undici's cookie parser (parseSetCookie) decodes cookie values, which can lead to HTTP response header injection. Applications that forward parsed cookie values into response headers become vulnerable to attacks such as session fixation or malicious redirects.

A vulnerability in Undici allows incorrect classification of responses as cacheable when Cache-Control headers contain whitespace. This can lead to authenticated user data being served to another user from the cache.

In the undici library, a vulnerability allows Socks5ProxyAgent to reuse a single connection pool across different origins without verifying origin match. This causes cross-origin request routing, credential leakage, and potential HTTPS downgrade to HTTP.

A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.

The undici WebSocket client does not limit the number of message fragments, allowing a malicious server to send many small continuation frames. This causes unbounded memory growth and denial of service (DoS).

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. A malicious server can send an out-of-range value (outside 8-15), causing an unhandled RangeError exception and immediate Node.js process termination.

A vulnerability in the undici library allows a server to send a WebSocket frame with a 64-bit length field containing an extremely large value. The ByteParser overflows internal math, enters an invalid state, and throws a fatal TypeError that terminates the process.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. A malicious WebSocket server can send a small compressed frame (a 'decompression bomb') that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.