GHSA-4qv8-2p9j-2685: Medium severity npm/undici vulnerability
Impact
undici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-based maxEventSize and maxResponseSize limits do not bound that retained state, and maxResponseSize is enforced on the compressed body before decompression, so a small compressed response can expand into enough retained memory to terminate the process. The application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response. Availability is the only impact.
Patches
Upgrade to 6.29.1, 7.30.1, or 8.12.2, which bound the retained EventSource parser state (the number of data fields and buffered chunks, the unfinished-line length, and per-field byte totals) independently of the byte limits.
Workarounds
None.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.12.2 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.30.1 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.29.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.29.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.30.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.12.2
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using undici's EventSource client are exposed when they keep an EventSource connection to an untrusted or compromised Server-Sent Events peer. The peer only needs control of the response; no authentication or user interaction is required.
Can the existing event or response size limits prevent this memory exhaustion?
No. maxEventSize and maxResponseSize do not bound the retained parser state involved in this issue. Additionally, maxResponseSize is applied to the compressed body before decompression, allowing a small compressed response to expand into sufficient retained memory to terminate the process.
What should teams do if they cannot patch immediately?
No workaround is provided. Upgrade undici to 6.29.1, 7.30.1, or 8.12.2, which add independent bounds for retained EventSource parser state.