Impact
Calling fetch(url) and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak.
Patches
Patched in v6.6.1
Workarounds
Make sure to always consume the incoming body.
Impact
Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.
Patches
This is patched in v5.28.3 and v6.6.1
Workarounds
There are no known workarounds.
References
- https://fetch.spec.whatwg.org/#authentication-entries - https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
Impact
Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().
Patches
This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
use fetch() or disable maxRedirections.
References
Linzi Shang reported this.
https://hackerone.com/reports/2408074 https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
Impact
If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.
Patches
Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
Ensure that integrity cannot be tampered with.
References
https://hackerone.com/reports/2377760