undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…undici/security/advisories/GHSA-3g9m-rv3r-w5w2 Diğer
• cna.openjsf.org/security-advisories.html Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:00Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-116630undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
• 5,9 CVE-2026-120415undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
• 5,9 CVE-2026-120423undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
• 7,4 CVE-2026-116592undici HTTP istemcisinde yönlendirme zincirinde önbellek zehirlenmesi ve kullanıcılar arası veri sızıntısı
• 6,5 CVE-2026-120474undici vulnerable to cross-user cache disclosure via same-origin redirect
• 7,5 CVE-2026-122315Kyverno'da attestation tipi işlenirken çökme ve görüntü doğrulamasının atlanması