Find, fix and prevent vulnerabilities in your code.
medium severity
new
- Vulnerable module: undici
- Introduced through: @top-gg/sdk@3.1.6, blwebhooks@3.5.11 and others
Detailed paths
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › @top-gg/sdk@3.1.6 › undici@5.29.0
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › blwebhooks@3.5.11 › @top-gg/sdk@3.1.6 › undici@5.29.0
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › discord.js@14.25.1 › undici@6.21.3
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › discord.js@14.25.1 › @discordjs/rest@2.6.0 › undici@6.21.3
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › blwebhooks@3.5.11 › discord.js@14.25.1 › undici@6.21.3
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › discord.js@14.25.1 › @discordjs/ws@1.2.3 › @discordjs/rest@2.6.0 › undici@6.21.3
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › blwebhooks@3.5.11 › discord.js@14.25.1 › @discordjs/rest@2.6.0 › undici@6.21.3
-
Introduced through: blwebhooks@Strider-Bot/BLWebhooks#8ca9edefa48a2f0fa4e94da01464fed33d890161 › blwebhooks@3.5.11 › discord.js@14.25.1 › @discordjs/ws@1.2.3 › @discordjs/rest@2.6.0 › undici@6.21.3
Overview
undici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the Content-Encoding header.
Remediation
Upgrade undici to version 6.23.0, 7.18.2 or higher.