beasty/beastypage
1
1
Fork 0
Code Issues 1 Pull requests 7 Releases 6 Packages 4 Activity Actions

chore(deps): update dependency undici to v8.9.0 [security] #44

Open
renovate-bot wants to merge 1 commit from renovate/npm-undici-vulnerability into main
pull from: renovate/npm-undici-vulnerability
merge into: beasty:main
Conversation 1 Commits 1 Files changed 1 +4 -4
renovate-bot commented 2026-08-04 03:32:42 +00:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
undici (source) 8.8.0 → 8.9.0 age confidence

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE-2026-13697 / GHSA-4cwx-7wf7-3272

More information

Details

Summary

Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js:

  1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.
  2. Parse-time crash: Mixed unqualified-and-qualified private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the cache-control parser, terminating the request.
Impact
Shared-cache disclosure

Applications using interceptors.cache() in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including Set-Cookie.

Required conditions:

  • the cache interceptor is enabled in shared mode, including the default configuration;
  • an upstream returns a malformed directive such as Cache-Control: public, max-age=300, private="";
  • another request later matches the same cache key, without a separating Vary header.
Parse-time crash

Applications using interceptors.cache() against an upstream that returns a Cache-Control header combining unqualified private with qualified private="..." see an uncaught TypeError: output.private.concat is not a function during response handling. The request rejects; depending on the consumer's error handling, the process may exit.

Details

private="" is parsed as { private: [''] }. The shared-cache guard only rejects private === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.

For the crash variant, an unqualified private directive sets output.private = true, then a subsequent qualified private="hdr" directive attempts output.private.concat(['hdr']), which throws because boolean has no concat method.

The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to true and preserves existing true values, closing both vectors.

Patches

Upgrade to undici 7.29.0 or 8.9.0. Both releases fix the qualified private directive handling that caused the shared-cache storage and the parser crash.

Workarounds

Until patched, avoid shared interceptors.cache() for user-specific responses, use type: 'private', or disable caching for affected origins.

Credit

Disclosure variant reported by @​h0rk1p via HackerOne report #​3817497.

Severity

  • CVSS Score: 7.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to downstream response desynchronization via retry interceptor

CVE-2026-16728 / GHSA-8xcm-r25x-g524

More information

Details

Impact

Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.

A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:

Content-Range: bytes 0-99/300
Content-Length: 300

and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.

The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds
  • Disable interceptors.retry() for untrusted upstreams.
  • Remove or recalculate Content-Length before forwarding a response body assembled or transformed by Undici.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

CVE-2026-14643 / GHSA-jr45-8vmc-qm54

More information

Details

Impact

Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.

Patches

Upgrade to undici v7.29.0 or v8.9.0.

Workarounds

If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to CRLF Injection via blob-like body 'type' property

CVE-2026-15157 / GHSA-m8rv-5g2x-5cg5

More information

Details

Impact

When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.

The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through isValidHeaderValue():

} else if (util.isBlobLike(body) && request.contentType == null && body.type) {
  headers.push('content-type', body.type)  // bypasses isValidHeaderValue()
}

The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled .type. Native Blob is safe because its constructor strips CRLF from .type. fetch() is unaffected because it validates via the Headers class. Ecosystem consumers that build duck-typed blob shapes from user input include form-data-encoder, formdata-polyfill, and formdata-node.

Same defect class as CVE-2022-35948 (explicit content-type sink, fixed in undici 5.8.2) and CVE-2026-1527 (upgrade option sink, fixed in 6.24.0 / 7.24.0), both closed by adding isValidHeaderValue() on their respective sinks. This branch was missed.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds
  • Set an explicit, validated content-type header on the request options (skips the vulnerable branch).
  • Use a native Blob (or fetch-blob) instead of a hand-rolled duck-typed object.
  • Reject control characters in the MIME type before assigning it to .type.
  • Use fetch() instead of the non-fetch APIs.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

CVE-2026-16729 / GHSA-v3r7-h72x-cjcm

More information

Details

Impact

The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.

Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0.

Workarounds
  • Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
  • Do not pass user-controlled data to the unparsed field.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici)

v8.9.0

Compare Source

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [undici](https://undici.nodejs.org) ([source](https://github.com/nodejs/undici)) | [`8.8.0` → `8.9.0`](https://renovatebot.com/diffs/npm/undici/8.8.0/8.9.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/undici/8.9.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/undici/8.8.0/8.9.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/20) for more information. --- ### undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives [CVE-2026-13697](https://nvd.nist.gov/vuln/detail/CVE-2026-13697) / [GHSA-4cwx-7wf7-3272](https://github.com/advisories/GHSA-4cwx-7wf7-3272) <details> <summary>More information</summary> #### Details ##### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=""` or `private=","` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key. 2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private="hdr"`) cause an uncaught `TypeError` in the cache-control parser, terminating the request. ##### Impact ##### Shared-cache disclosure Applications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`. Required conditions: - the cache interceptor is enabled in shared mode, including the default configuration; - an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=""`; - another request later matches the same cache key, without a separating `Vary` header. ##### Parse-time crash Applications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private="..."` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer's error handling, the process may exit. ##### Details `private=""` is parsed as `{ private: [''] }`. The shared-cache guard only rejects `private === true`, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user. For the crash variant, an unqualified `private` directive sets `output.private = true`, then a subsequent qualified `private="hdr"` directive attempts `output.private.concat(['hdr'])`, which throws because boolean has no `concat` method. The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to `true` and preserves existing `true` values, closing both vectors. ##### Patches Upgrade to `undici` 7.29.0 or 8.9.0. Both releases fix the qualified `private` directive handling that caused the shared-cache storage and the parser crash. ##### Workarounds Until patched, avoid shared `interceptors.cache()` for user-specific responses, use `type: 'private'`, or disable caching for affected origins. ##### Credit Disclosure variant reported by @&#8203;h0rk1p via HackerOne report [#&#8203;3817497](https://hackerone.com/reports/3817497). #### Severity - CVSS Score: 7.4 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272) - [https://nvd.nist.gov/vuln/detail/CVE-2026-13697](https://nvd.nist.gov/vuln/detail/CVE-2026-13697) - [https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451](https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0) - [https://github.com/nodejs/undici/releases/tag/v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4cwx-7wf7-3272) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to downstream response desynchronization via retry interceptor [CVE-2026-16728](https://nvd.nist.gov/vuln/detail/CVE-2026-16728) / [GHSA-8xcm-r25x-g524](https://github.com/advisories/GHSA-8xcm-r25x-g524) <details> <summary>More information</summary> #### Details ##### Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length` header exposed to the application after a retry or resume of a partial response. Applications that use `interceptors.retry()` and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale `Content-Length` header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata. A malicious or faulty upstream can respond to a range request with a `206 Partial Content` response such as: ```http Content-Range: bytes 0-99/300 Content-Length: 300 ``` and then send only 99 bytes before closing the socket. `interceptors.retry()` can then retry with `Range: bytes=99-99`, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain `Content-Length: 300` from the first response. The bug requires `interceptors.retry()` to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate `Content-Length`. ##### Patches Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later. ##### Workarounds - Disable `interceptors.retry()` for untrusted upstreams. - Remove or recalculate `Content-Length` before forwarding a response body assembled or transformed by Undici. #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524](https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524) - [https://nvd.nist.gov/vuln/detail/CVE-2026-16728](https://nvd.nist.gov/vuln/detail/CVE-2026-16728) - [https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c](https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c) - [https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a](https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a) - [https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7](https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7) - [https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420](https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420) - [https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e](https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e) - [https://github.com/nodejs/undici/commit/e11a68ed4ff345c79402476f7a00d473443e318d](https://github.com/nodejs/undici/commit/e11a68ed4ff345c79402476f7a00d473443e318d) - [https://hackerone.com/reports/3828685](https://hackerone.com/reports/3828685) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0) - [https://github.com/nodejs/undici/releases/tag/v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0) - [https://github.com/nodejs/undici/releases/tag/v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8xcm-r25x-g524) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives [CVE-2026-14643](https://nvd.nist.gov/vuln/detail/CVE-2026-14643) / [GHSA-jr45-8vmc-qm54](https://github.com/advisories/GHSA-jr45-8vmc-qm54) <details> <summary>More information</summary> #### Details ##### Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache ="authorization"` (OWS before `=`) or `no-cache= "authorization"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize. Affected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`. ##### Patches Upgrade to undici v7.29.0 or v8.9.0. ##### Workarounds If upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream. #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54](https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54) - [https://nvd.nist.gov/vuln/detail/CVE-2026-14643](https://nvd.nist.gov/vuln/detail/CVE-2026-14643) - [https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9](https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9) - [https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc](https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0) - [https://github.com/nodejs/undici/releases/tag/v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jr45-8vmc-qm54) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to CRLF Injection via blob-like body 'type' property [CVE-2026-15157](https://nvd.nist.gov/vuln/detail/CVE-2026-15157) / [GHSA-m8rv-5g2x-5cg5](https://github.com/advisories/GHSA-m8rv-5g2x-5cg5) <details> <summary>More information</summary> #### Details ##### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\r\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream. The vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`: ```javascript } else if (util.isBlobLike(body) && request.contentType == null && body.type) { headers.push('content-type', body.type) // bypasses isValidHeaderValue() } ``` The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled `.type`. Native `Blob` is safe because its constructor strips CRLF from `.type`. `fetch()` is unaffected because it validates via the `Headers` class. Ecosystem consumers that build duck-typed blob shapes from user input include `form-data-encoder`, `formdata-polyfill`, and `formdata-node`. Same defect class as `CVE-2022-35948` (explicit `content-type` sink, fixed in undici 5.8.2) and `CVE-2026-1527` (`upgrade` option sink, fixed in 6.24.0 / 7.24.0), both closed by adding `isValidHeaderValue()` on their respective sinks. This branch was missed. ##### Patches Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later. ##### Workarounds - Set an explicit, validated `content-type` header on the request options (skips the vulnerable branch). - Use a native `Blob` (or `fetch-blob`) instead of a hand-rolled duck-typed object. - Reject control characters in the MIME type before assigning it to `.type`. - Use `fetch()` instead of the non-`fetch` APIs. #### Severity - CVSS Score: 4.2 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5](https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-15157](https://nvd.nist.gov/vuln/detail/CVE-2026-15157) - [https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d](https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d) - [https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400](https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400) - [https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42](https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0) - [https://github.com/nodejs/undici/releases/tag/v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0) - [https://github.com/nodejs/undici/releases/tag/v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m8rv-5g2x-5cg5) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields [CVE-2026-16729](https://nvd.nist.gov/vuln/detail/CVE-2026-16729) / [GHSA-v3r7-h72x-cjcm](https://github.com/advisories/GHSA-v3r7-h72x-cjcm) <details> <summary>More information</summary> #### Details ##### Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without the caller setting `cookie.httpOnly = true`. Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, `Secure` or `HttpOnly` forced or stripped, or the intended SameSite tier overridden. ##### Patches Patched in undici v6.28.0, v7.29.0, and v8.9.0. ##### Workarounds - Sanitize `domain` values against the RFC 1034 letter-digit-hyphen set before passing to `setCookie`. - Do not pass user-controlled data to the `unparsed` field. #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm](https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm) - [https://nvd.nist.gov/vuln/detail/CVE-2026-16729](https://nvd.nist.gov/vuln/detail/CVE-2026-16729) - [https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5](https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5) - [https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef](https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef) - [https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235](https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0) - [https://github.com/nodejs/undici/releases/tag/v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0) - [https://github.com/nodejs/undici/releases/tag/v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v3r7-h72x-cjcm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>nodejs/undici (undici)</summary> ### [`v8.9.0`](https://github.com/nodejs/undici/compare/1760faa557f5f29c6dbd33fcbe6b0422cee16856...21a8e1ed1843e74c3004a2926c12bb0ceaca6b71) [Compare Source](https://github.com/nodejs/undici/compare/1760faa557f5f29c6dbd33fcbe6b0422cee16856...21a8e1ed1843e74c3004a2926c12bb0ceaca6b71) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzkuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI3OS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
renovate-bot commented 2026-08-05 03:32:47 +00:00
Author
Collaborator
Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/media_service/pnpm-lock.yaml
undefined
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: backend/media_service/pnpm-lock.yaml ``` undefined ```
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/npm-undici-vulnerability:renovate/npm-undici-vulnerability
git switch renovate/npm-undici-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/npm-undici-vulnerability
git switch renovate/npm-undici-vulnerability
git rebase main
git switch main
git merge --ff-only renovate/npm-undici-vulnerability
git switch renovate/npm-undici-vulnerability
git rebase main
git switch main
git merge --no-ff renovate/npm-undici-vulnerability
git switch main
git merge --squash renovate/npm-undici-vulnerability
git switch main
git merge --ff-only renovate/npm-undici-vulnerability
git switch main
git merge renovate/npm-undici-vulnerability
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
beasty/beastypage!44
No description provided.