Vulnerabilities

 12 via 12 paths

Dependencies

 296

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 12
  • 1
Severity
  • 1
  • 6
  • 6
Status
  • 13
  • 0
  • 0

critical severity
new

CRLF Injection

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

Workaround

This vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.

Remediation

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

References

CRLF Injection vulnerability report

high severity
new

Use of Cache Containing Sensitive Information

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the Cache-Control header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.

Note: This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.

Workaround

This vulnerability can be mitigated by disabling shared-cache mode for traffic that includes Authorization headers, avoiding caching responses to authenticated requests, or adding Vary: Authorization upstream.

Remediation

Upgrade undici to version 7.28.0, 8.5.0 or higher.

References

Use of Cache Containing Sensitive Information vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: tar
  • Introduced through: tar@7.5.15

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › tar@7.5.15
    Remediation: Upgrade to tar@7.5.19.

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.

Remediation

Upgrade tar to version 7.5.19 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity
new

Infinite loop

  • Vulnerable module: tar
  • Introduced through: tar@7.5.15

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › tar@7.5.15
    Remediation: Upgrade to tar@7.5.18.

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.

Remediation

Upgrade tar to version 7.5.18 or higher.

References

Infinite loop vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of fragmented WebSocket messages. An attacker can cause unbounded memory growth and exhaust system resources by sending numerous small fragments that individually pass validation but collectively exceed the intended payload size limit.

Remediation

Upgrade undici to version 8.5.0 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

Remediation

Upgrade undici to version 6.26.0, 7.28.0, 8.5.0 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity
new

Permissive List of Allowed Inputs

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

Workaround

This vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.

Remediation

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

References

Permissive List of Allowed Inputs vulnerability report

medium severity
new

Incorrect Type Conversion or Cast

  • Vulnerable module: tar
  • Introduced through: tar@7.5.15

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › tar@7.5.15
    Remediation: Upgrade to tar@7.5.18.

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the src/pax.ts file. An attacker can cause a process crash by providing all-digit PAX path or linkpath values that are coerced to JavaScript numbers, leading to a TypeError during downstream path handling.

Remediation

Upgrade tar to version 7.5.18 or higher.

References

Incorrect Type Conversion or Cast vulnerability report

medium severity
new

Interpretation Conflict

  • Vulnerable module: tar
  • Introduced through: tar@7.5.15

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › tar@7.5.15
    Remediation: Upgrade to tar@7.5.16.

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of PAX extended header size overrides in intermediary metadata headers. An attacker can cause inconsistent archive parsing results between different tar implementations by crafting a malicious tar archive that desynchronizes the parser's interpretation, potentially hiding files from scanners or extractors that rely on different tools.

Remediation

Upgrade tar to version 7.5.16 or higher.

References

Interpretation Conflict vulnerability report

medium severity
new

Uncaught Exception

  • Vulnerable module: tar
  • Introduced through: tar@7.5.15

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › tar@7.5.15
    Remediation: Upgrade to tar@7.5.17.

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncaught Exception through improper handling of NUL bytes in the src/pax.ts file. An attacker can cause the application to terminate unexpectedly by providing a crafted archive containing NUL bytes in PAX path or linkpath records, which leads to an uncaught exception when these values are passed to filesystem operations.

Remediation

Upgrade tar to version 7.5.17 or higher.

References

Uncaught Exception vulnerability report

medium severity
new

Time-of-check Time-of-use (TOCTOU) Race Condition

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive socket after a request completes. An attacker can cause responses to be delivered to the wrong requests by sending crafted HTTP responses through a compromised or malicious upstream server.

Note: This is only exploitable if the upstream HTTP/1.1 server is attacker-controlled or compromised and keep-alive connection reuse is enabled.

Workaround

This vulnerability can be mitigated by disabling keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

Remediation

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

References

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability report

medium severity
new

Improper Certificate Validation

  • Vulnerable module: undici
  • Introduced through: undici@8.3.0

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › undici@8.3.0
    Remediation: Upgrade to undici@8.5.0.

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Certificate Validation in the ProxyAgent when configured with a SOCKS5 proxy URI, which causes the requestTls option to be silently dropped. An attacker can intercept and tamper with HTTPS traffic by exploiting the fallback to the default trust store, thereby bypassing user-configured TLS restrictions.

Note: This is only exploitable if the application uses a SOCKS5 proxy and relies on requestTls for TLS scope restriction.

Workaround

This vulnerability can be mitigated by routing traffic through an HTTP-proxy ProxyAgent instead of SOCKS5, where requestTls is honored correctly.

Remediation

Upgrade undici to version 7.28.0, 8.5.0 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

MPL-2.0 license

  • Module: web-push
  • Introduced through: web-push@3.6.7

Detailed paths

  • Introduced through: vilvona@vignesh2027/Vilvona-AI › web-push@3.6.7

MPL-2.0 license

MPL-2.0 license vulnerability report