Ulisesgascon

**Name of the Vulnerable Software and Affected Versions** undici versions 6.x prior to 6.26.0 undici versions 7.0.0 through 7.27.x undici versions 8.x prior to 8.5.0 **Description** The cookie parser in the `parseSetCookie` function percent-decodes cookie values using `qsUnescape`, which converts encoded sequences such as %0D%0A, %00, %3B, and %3D into literal byte equivalents. This behavior deviates from RFC 6265 §5.4 and browser standards, which do not specify such decoding. Applications that use `parseSetCookie`, `parseCookie`, or `getSetCookies` and subsequently forward these parsed values into response headers (such as proxies, middleware, or SSR frameworks) are susceptible to HTTP response header injection. This allows an attacker-controlled upstream source to inject arbitrary Set-Cookie, Location, or Cache-Control headers into the downstream response, potentially leading to session fixation, open redirect, or cache poisoning. **Recommendations** Upgrade to version 6.26.0 for versions in the 6.x branch. Upgrade to version 7.28.0 for versions in the 7.x branch. Upgrade to version 8.5.0 for versions in the 8.x branch. As a temporary workaround, sanitize values returned by `parseSetCookie()`, `parseCookie()`, or `getSetCookies()` to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.17.0 through 6.25.x undici versions 7.0.0 through 7.27.x undici versions 8.0.0 through 8.4.x **Description** The WebSocket client fails to limit the number of fragments in a message, only enforcing the `maxPayloadSize` on the cumulative byte count. A malicious server can send numerous small or empty continuation frames that bypass per-frame and cumulative-size validation, leading to unbounded memory growth, memory exhaustion, and a denial of service. This affects applications using the `new WebSocket(...)` client or the WebSocketStream API when connecting to a compromised or attacker-controlled endpoint. **Recommendations** Upgrade to version 6.26.0 or later for the 6.x branch. Upgrade to version 7.28.0 or later for the 7.x branch. Upgrade to version 8.5.0 or later for the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.23.0 through 7.27.x undici versions 8.0.0 through 8.4.x **Description** The ProxyAgent in undici silently drops the `requestTls` option when configured with a SOCKS5 proxy URI (`socks5://` or `socks://`). This causes the target HTTPS connection through the SOCKS5 tunnel to fall back to the default Node.js trust store, ignoring user-defined settings such as `ca`, `cert`, `key`, `rejectUnauthorized`, and `servername`. Consequently, applications that rely on `requestTls.ca` to pin to an internal or corporate Certificate Authority (CA) will instead use the default Mozilla CA bundle. This allows any certificate signed by a publicly trusted CA for the target hostname to be accepted, enabling Man-in-the-Middle (MITM) attacks to read and tamper with the HTTPS exchange. **Recommendations** Upgrade to version 7.28.0. Upgrade to version 8.5.0. Route traffic through an HTTP-proxy ProxyAgent instead of a SOCKS5 proxy to ensure `requestTls` is honored correctly.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 7.28.0 undici versions prior to 8.5.0 **Description** The cache interceptor incorrectly classifies certain responses as cacheable when the upstream Cache-Control header contains whitespace-padded qualified private or no-cache field names, such as `private=" authorization"` or `no-cache="tauthorization"`. Because the parser preserves this surrounding whitespace, comparisons against the literal `authorization` field name fail, causing the response to be stored. In shared-cache mode, this can lead to cross-user information disclosure, where a response containing one user's authenticated data is served from the cache to a subsequent caller, including unauthenticated users, if both requests share the same cache key. **Recommendations** Upgrade to version 7.28.0. Upgrade to version 8.5.0. Disable shared-cache mode for traffic that includes Authorization headers. Avoid caching responses to authenticated requests. Add `Vary: Authorization` upstream.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.23.0 through 8.1.0 **Description** When using `Socks5ProxyAgent`, the software reuses a single connection pool across different origins without verifying if the pool's origin matches the requested origin. This leads to cross-origin request routing, where all requests are dispatched through the pool connected to the first origin regardless of the intended destination. Consequently, credentials and request data meant for one origin are sent to another, responses from incorrect origins are trusted, and HTTPS requests may be silently downgraded to HTTP. **Recommendations** For versions 7.23.0 through 7.25.x, upgrade to version 7.26.0. For versions 8.0.0 through 8.1.0, upgrade to version 8.2.0. Use a separate `Socks5ProxyAgent` instance per origin. Avoid using `Socks5ProxyAgent` with multiple origins.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.26.0 undici versions prior to 7.28.0 undici versions prior to 8.5.0 **Description** The HTTP/1.1 client is subject to response queue poisoning when keep-alive sockets are reused. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request has finished. Consequently, when the client sends a subsequent request using that same socket, it incorrectly associates the injected response with the new request, leading to responses being delivered to the wrong requests. This issue requires a compromised or attacker-controlled upstream HTTP/1.1 server and the use of keep-alive connection reuse. **Recommendations** Upgrade to version 6.26.0. Upgrade to version 7.28.0. Upgrade to version 8.5.0. As a temporary workaround, disable keep-alive connection reuse by setting the `keepAliveTimeout` variable to 0 on the Client or Pool.

**Name of the Vulnerable Software and Affected Versions** undici versions 5.15.0 through 6.25.x undici versions 7.0.0 through 7.27.x undici versions 8.0.0 through 8.4.x **Description** When parsing a Set-Cookie header, the software accepts any SameSite attribute value containing Strict, Lax, or None as a substring instead of requiring a case-insensitive exact match as specified by RFC 6265. This allows non-spec values to be silently mapped to standard tokens; for instance, SameSite=NoneOfYourBusiness is parsed as None, and SameSite=StrictLax is parsed as Lax. Applications that consume Set-Cookie headers via fetch or proxy code paths and rely on the parsed `sameSite` attribute can be coerced by a malicious or non-compliant server into applying a weaker SameSite policy, degrading the intended cookie enforcement. **Recommendations** Upgrade to version 6.26.0. Upgrade to version 7.28.0. Upgrade to version 8.5.0. As a temporary workaround, validate that the resulting `sameSite` attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) after parsing a Set-Cookie header and before relying on it.

**Name of the Vulnerable Software and Affected Versions** undici version 8.1.0 **Description** The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints. **Recommendations** Upgrade to undici versions 8.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-server versions prior to 5.2.5 **Description** A permissive user-configured proxy with a broad context (e.g., '/') and `ws: true` intercepts the development server's own Hot Module Replacement (HMR) WebSocket and forwards it to the proxy target. This results in the leakage of the browser's cookies and Origin header to the backend and bypasses the development server's Host/Origin validation. Additionally, this causes corruption of the HMR socket as both the HMR and the proxy attempt to write to the same socket. **Recommendations** Update to version 5.2.5. Scope user-defined proxy context to specific paths instead of '/'. Omit `ws: true` from the proxy entry when WebSocket forwarding is not required.

**Name of the Vulnerable Software and Affected Versions** multer versions 1.0.0 through 2.1.1 multer version 3.0.0-alpha.1 **Description** A Denial of Service issue exists due to the way the `append-field` dependency parses bracket notation in field names within multipart form data. Because there is no limit on nesting depth, an attacker can send a single HTTP request with a crafted multipart body to force the allocation of deeply nested object structures, leading to excessive CPU and memory consumption. **Recommendations** For versions 1.0.0 through 2.1.1, upgrade to version 2.2.0 and configure the `limits.fieldNestingDepth` option to the minimum depth required by the application. For version 3.0.0-alpha.1, upgrade to version 3.0.0-alpha.2 and configure the `limits.fieldNestingDepth` option to the minimum depth required by the application. As a temporary mitigation, set `limits.fields` to a reasonable value to reduce the number of fields allowed per request.

**Name of the Vulnerable Software and Affected Versions** multer versions 2.0.0-alpha.1 through 2.1.1 multer version 3.0.0-alpha.1 **Description** A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads. **Recommendations** Upgrade to version 2.2.0 for versions 2.0.0-alpha.1 through 2.1.1. Upgrade to version 3.0.0-alpha.2 for version 3.0.0-alpha.1.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions prior to 9.3.2 **Description** A middleware bypass exists when the deprecated `ignoreDuplicateSlashes` option is enabled. The middleware path matching logic fails to account for duplicate slash normalization performed by the router, allowing requests with duplicate leading slashes (e.g., '//admin/secret') to bypass authentication and authorization checks. This issue specifically affects applications using the deprecated top-level configuration style `fastify({ ignoreDuplicateSlashes: true })` rather than the `routerOptions` configuration. **Recommendations** Upgrade to @fastify/middie version 9.3.2. As a temporary workaround, migrate from the deprecated top-level `ignoreDuplicateSlashes: true` configuration to `routerOptions: { ignoreDuplicateSlashes: true }` or disable the `ignoreDuplicateSlashes` option.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** @fastify/static decodes percent-encoded path separators ('%2F') before filesystem resolution, whereas the Fastify router treats them as literal characters. This discrepancy allows for a routing mismatch where route guards or middleware protecting specific paths can be bypassed. For instance, a guard protecting '/admin/*' will not match a request for '/admin%2Fsecret.html', but the software will decode the request and serve the file from '/admin/secret.html'. **Recommendations** Upgrade to @fastify/static version 9.1.1.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions prior to 9.3.2 **Description** Inherited middleware is not registered directly on child plugin engine instances. When authentication middleware is registered in a parent scope and child plugins are registered with @fastify/middie, the child scope fails to inherit the parent middleware. This occurs because middleware paths are incorrectly re-prefixed when propagated to child plugin scopes; if a child plugin is registered with a prefix overlapping a parent-scoped middleware path, the path is modified and fails to match incoming requests. Consequently, security controls such as authentication, authorization, and rate limiting are skipped for all routes defined within affected child and nested grandchild plugin scopes, allowing unauthenticated requests to reach those routes. **Recommendations** Upgrade to @fastify/middie version 9.3.2.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** Path traversal occurs when directory listing is enabled via the `list` option. The `dirList.path()` function resolves directories outside the configured static root using `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed. **Recommendations** Upgrade to version 9.1.1. As a temporary workaround, disable directory listing by removing the `list` option from the plugin configuration.

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions prior to 12.6.2 @fastify/http-proxy versions prior to 11.4.4 **Description** A logic flaw in the header processing pipeline of the Node.js Fastify framework allows unauthenticated remote attackers to bypass security controls. The issue occurs because the `rewriteRequestHeaders()` function processes the client's `Connection` header after the proxy has added its own headers. This allows an attacker to retroactively strip headers added by the proxy for routing, access control, or security purposes by listing them in the `Connection` header value. This can lead to unauthorized modification of protected information or the bypass of proxy identification and authorization mechanisms. **Recommendations** Upgrade @fastify/reply-from to version 12.6.2 or later. Upgrade @fastify/http-proxy to version 11.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** An issue exists where the software fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows an unauthenticated attacker to bypass path-scoped authentication middleware by manipulating the URL path. Specifically, the bypass occurs via duplicate slashes when `ignoreDuplicateSlashes` is enabled, or via semicolon delimiters when `useSemicolonDelimiter` is enabled. In these scenarios, the Fastify router normalizes the URL to match the route, but the original un-normalized URL is passed to Express middleware, causing it to fail to match and be skipped. **Recommendations** Upgrade to @fastify/express v4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** A path handling bug in the `onRegister()` function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware path, the path is prefixed a second time, preventing it from matching incoming requests. This leads to a complete bypass of Express middleware security controls, such as authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. **Recommendations** Upgrade to version 4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions 5.3.2 through 5.8.4 **Description** Applications using `schema.body.content` for per-content-type body validation are subject to a validation bypass. By prepending a space to the Content-Type header, the body is still parsed correctly, but the schema validation is skipped entirely. **Recommendations** Upgrade to version 5.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** Lodash versions prior to 4.18.0 **Description** Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior. **Recommendations** Upgrade to version 4.18.0 or later.