Vulnerabilities

 1 via 3 paths

Dependencies

 71

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: undici
  • Introduced through: @actions/github@6.0.1 and @actions/core@1.11.1

Detailed paths

  • Introduced through: mantis-bug-tracker-action@mjorgegulab/mantis-bug-tracker-action › @actions/github@6.0.1 › undici@5.29.0
  • Introduced through: mantis-bug-tracker-action@mjorgegulab/mantis-bug-tracker-action › @actions/core@1.11.1 › @actions/http-client@2.2.3 › undici@5.29.0
  • Introduced through: mantis-bug-tracker-action@mjorgegulab/mantis-bug-tracker-action › @actions/github@6.0.1 › @actions/http-client@2.2.3 › undici@5.29.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decompression chain. An attacker can cause high CPU usage and excessive memory allocation by sending HTTP responses with a large number of chained compression steps in the Content-Encoding header.

Remediation

Upgrade undici to version 6.23.0, 7.18.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report