Mcollina

**Name of the Vulnerable Software and Affected Versions** undici version 8.1.0 **Description** The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints. **Recommendations** Upgrade to undici versions 8.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.x prior to 6.26.0 undici versions 7.0.0 through 7.27.x undici versions 8.x prior to 8.5.0 **Description** The cookie parser in the `parseSetCookie` function percent-decodes cookie values using `qsUnescape`, which converts encoded sequences such as %0D%0A, %00, %3B, and %3D into literal byte equivalents. This behavior deviates from RFC 6265 §5.4 and browser standards, which do not specify such decoding. Applications that use `parseSetCookie`, `parseCookie`, or `getSetCookies` and subsequently forward these parsed values into response headers (such as proxies, middleware, or SSR frameworks) are susceptible to HTTP response header injection. This allows an attacker-controlled upstream source to inject arbitrary Set-Cookie, Location, or Cache-Control headers into the downstream response, potentially leading to session fixation, open redirect, or cache poisoning. **Recommendations** Upgrade to version 6.26.0 for versions in the 6.x branch. Upgrade to version 7.28.0 for versions in the 7.x branch. Upgrade to version 8.5.0 for versions in the 8.x branch. As a temporary workaround, sanitize values returned by `parseSetCookie()`, `parseCookie()`, or `getSetCookies()` to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 7.28.0 undici versions prior to 8.5.0 **Description** The cache interceptor incorrectly classifies certain responses as cacheable when the upstream Cache-Control header contains whitespace-padded qualified private or no-cache field names, such as `private=" authorization"` or `no-cache="tauthorization"`. Because the parser preserves this surrounding whitespace, comparisons against the literal `authorization` field name fail, causing the response to be stored. In shared-cache mode, this can lead to cross-user information disclosure, where a response containing one user's authenticated data is served from the cache to a subsequent caller, including unauthenticated users, if both requests share the same cache key. **Recommendations** Upgrade to version 7.28.0. Upgrade to version 8.5.0. Disable shared-cache mode for traffic that includes Authorization headers. Avoid caching responses to authenticated requests. Add `Vary: Authorization` upstream.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.23.0 through 8.1.0 **Description** When using `Socks5ProxyAgent`, the software reuses a single connection pool across different origins without verifying if the pool's origin matches the requested origin. This leads to cross-origin request routing, where all requests are dispatched through the pool connected to the first origin regardless of the intended destination. Consequently, credentials and request data meant for one origin are sent to another, responses from incorrect origins are trusted, and HTTPS requests may be silently downgraded to HTTP. **Recommendations** For versions 7.23.0 through 7.25.x, upgrade to version 7.26.0. For versions 8.0.0 through 8.1.0, upgrade to version 8.2.0. Use a separate `Socks5ProxyAgent` instance per origin. Avoid using `Socks5ProxyAgent` with multiple origins.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.26.0 undici versions prior to 7.28.0 undici versions prior to 8.5.0 **Description** The HTTP/1.1 client is subject to response queue poisoning when keep-alive sockets are reused. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request has finished. Consequently, when the client sends a subsequent request using that same socket, it incorrectly associates the injected response with the new request, leading to responses being delivered to the wrong requests. This issue requires a compromised or attacker-controlled upstream HTTP/1.1 server and the use of keep-alive connection reuse. **Recommendations** Upgrade to version 6.26.0. Upgrade to version 7.28.0. Upgrade to version 8.5.0. As a temporary workaround, disable keep-alive connection reuse by setting the `keepAliveTimeout` variable to 0 on the Client or Pool.

**Name of the Vulnerable Software and Affected Versions** undici versions 5.15.0 through 6.25.x undici versions 7.0.0 through 7.27.x undici versions 8.0.0 through 8.4.x **Description** When parsing a Set-Cookie header, the software accepts any SameSite attribute value containing Strict, Lax, or None as a substring instead of requiring a case-insensitive exact match as specified by RFC 6265. This allows non-spec values to be silently mapped to standard tokens; for instance, SameSite=NoneOfYourBusiness is parsed as None, and SameSite=StrictLax is parsed as Lax. Applications that consume Set-Cookie headers via fetch or proxy code paths and rely on the parsed `sameSite` attribute can be coerced by a malicious or non-compliant server into applying a weaker SameSite policy, degrading the intended cookie enforcement. **Recommendations** Upgrade to version 6.26.0. Upgrade to version 7.28.0. Upgrade to version 8.5.0. As a temporary workaround, validate that the resulting `sameSite` attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) after parsing a Set-Cookie header and before relying on it.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** Path traversal occurs when directory listing is enabled via the `list` option. The `dirList.path()` function resolves directories outside the configured static root using `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed. **Recommendations** Upgrade to version 9.1.1. As a temporary workaround, disable directory listing by removing the `list` option from the plugin configuration.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions prior to 9.3.2 **Description** A middleware bypass exists when the deprecated `ignoreDuplicateSlashes` option is enabled. The middleware path matching logic fails to account for duplicate slash normalization performed by the router, allowing requests with duplicate leading slashes (e.g., '//admin/secret') to bypass authentication and authorization checks. This issue specifically affects applications using the deprecated top-level configuration style `fastify({ ignoreDuplicateSlashes: true })` rather than the `routerOptions` configuration. **Recommendations** Upgrade to @fastify/middie version 9.3.2. As a temporary workaround, migrate from the deprecated top-level `ignoreDuplicateSlashes: true` configuration to `routerOptions: { ignoreDuplicateSlashes: true }` or disable the `ignoreDuplicateSlashes` option.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** @fastify/static decodes percent-encoded path separators ('%2F') before filesystem resolution, whereas the Fastify router treats them as literal characters. This discrepancy allows for a routing mismatch where route guards or middleware protecting specific paths can be bypassed. For instance, a guard protecting '/admin/*' will not match a request for '/admin%2Fsecret.html', but the software will decode the request and serve the file from '/admin/secret.html'. **Recommendations** Upgrade to @fastify/static version 9.1.1.

**Name of the Vulnerable Software and Affected Versions** fastify versions 5.3.2 through 5.8.4 **Description** Applications using `schema.body.content` for per-content-type body validation are subject to a validation bypass. By prepending a space to the Content-Type header, the body is still parsed correctly, but the schema validation is skipped entirely. **Recommendations** Upgrade to version 5.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions prior to 12.6.2 @fastify/http-proxy versions prior to 11.4.4 **Description** A logic flaw in the header processing pipeline of the Node.js Fastify framework allows unauthenticated remote attackers to bypass security controls. The issue occurs because the `rewriteRequestHeaders()` function processes the client's `Connection` header after the proxy has added its own headers. This allows an attacker to retroactively strip headers added by the proxy for routing, access control, or security purposes by listing them in the `Connection` header value. This can lead to unauthorized modification of protected information or the bypass of proxy identification and authorization mechanisms. **Recommendations** Upgrade @fastify/reply-from to version 12.6.2 or later. Upgrade @fastify/http-proxy to version 11.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** An issue exists where the software fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows an unauthenticated attacker to bypass path-scoped authentication middleware by manipulating the URL path. Specifically, the bypass occurs via duplicate slashes when `ignoreDuplicateSlashes` is enabled, or via semicolon delimiters when `useSemicolonDelimiter` is enabled. In these scenarios, the Fastify router normalizes the URL to match the route, but the original un-normalized URL is passed to Express middleware, causing it to fail to match and be skipped. **Recommendations** Upgrade to @fastify/express v4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** A path handling bug in the `onRegister()` function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware path, the path is prefixed a second time, preventing it from matching incoming requests. This leads to a complete bypass of Express middleware security controls, such as authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. **Recommendations** Upgrade to version 4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Fastify versions prior to 5.7.3 **Description** Fastify is a web framework for Node.js. A denial-of-service condition exists in Fastify’s Web Streams response handling. A slow or non-reading client can cause unbounded buffering when backpressure is ignored, potentially leading to process crashes or significant performance degradation. Applications utilizing `reply.send()` to return a `ReadableStream` or a `Response` with a Web Stream body are susceptible. The issue can allow a remote client to exhaust server memory. **Recommendations** Versions prior to 5.7.3 should be upgraded to version 5.7.3 or later. As a workaround, avoid sending Web Streams from Fastify responses (e.g., `ReadableStream` or `Response` bodies). Use Node.js streams (`stream.Readable`) or buffered payloads instead.

**Name of the Vulnerable Software and Affected Versions** Undici versions prior to 7.18.0 Undici versions prior to 6.23.0 **Description** Undici is an HTTP/1.1 client for Node.js. A malicious server can insert thousands of compression steps due to an unbounded number of links in the decompression chain and the default `maxHeaderSize`, leading to high CPU usage and excessive memory allocation. The `fetch()` API supports chained HTTP encoding algorithms for response content, which is also supported by the undici decompress interceptor. **Recommendations** Upgrade to version 7.18.0 or 6.23.0. As a workaround, apply an undici interceptor to filter long `Content-Encoding` sequences manually.

**Name of the Vulnerable Software and Affected Versions** Fastify versions 4.29.0 through 5.3.1 Fastify version 4.9.0 **Description** Fastify is a fast, low overhead web framework for Node.js. Applications specifying different validation strategies for different content types may bypass validation by providing a slightly altered content type, such as with different casing or altered whitespace before the semicolon (;). This issue affects applications using a specific schema pattern where individual content types are defined with their own schemas. The initial patch in version 5.3.1 did not fully address the problem, and a complete fix was released in version 5.3.2 and 4.29.1. **Recommendations** Fastify versions 4.29.0 through 5.3.1: Upgrade to version 5.3.2 or 4.29.1 to resolve the issue. Fastify version 4.9.0: Upgrade to version 4.9.1 to resolve the issue. As a workaround for all affected versions, avoid specifying individual content types in the schema.

**Name of the Vulnerable Software and Affected Versions** @fastify/multipart versions prior to 8.3.1 and 9.0.3 **Description** The issue is related to the `saveRequestFiles` function in the @fastify/multipart plugin for Fastify, which fails to delete uploaded temporary files when a user cancels a request. This can be exploited by a remote attacker to cause a denial of service by sending a specially crafted request. The problem is caused by the incorrect handling of authentication tokens due to unlimited resource allocation. **Recommendations** For versions prior to 8.3.1, update to version 8.3.1 or later. For versions prior to 9.0.3, update to version 9.0.3 or later. As a temporary workaround, do not use the `saveRequestFiles` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Undici versions prior to 5.28.4 Undici versions prior to 6.11.1 **Description** The issue is related to the Undici HTTP/1.1 client for Node.js, which has a flaw in its authorization procedure. Specifically, Undici clears Authorization and Proxy-Authorization headers for `fetch()`, but fails to do so for `undici.request()`. This could potentially allow a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 5.28.4, update to version 5.28.4 or later. For versions prior to 6.11.1, update to version 6.11.1 or later. As a temporary workaround, consider using `fetch()` instead of `undici.request()`. Alternatively, disable `maxRedirections` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Undici versions prior to 6.6.1 **Description** The issue is related to the `fetch()` function of the Undici HTTP/1.1 client for Node.js, which can lead to uncontrolled resource consumption. This can be exploited by a remote attacker to cause a denial of service. The problem arises when `fetch(url)` is called and the incoming body is not consumed or is consumed very slowly, resulting in a memory leak. **Recommendations** For versions prior to 6.6.1, upgrade to version 6.6.1 or later to resolve the issue. For users unable to upgrade, make sure to always consume the incoming body when calling `fetch(url)` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** @fastify/multipart versions prior to 6.0.1 and 7.4.1 **Description** The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body parser accepting an unlimited number of file parts, field parts, and empty parts as field parts. **Recommendations** For versions prior to 6.0.1, update to version 6.0.1 or later. For versions prior to 7.4.1, update to version 7.4.1 or later.