Snyk test report

Missing Release of Resource after Effective Lifetime

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like response.body.text() never complete. This requires the application to retry requests through the RetryHandler, and bodyTimeout does not fire because the orphaned body is never active.

Workaround

This vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since bodyTimeout alone does not release the orphaned body.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Allocation of Resources Without Limits or Throttling

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress() interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose Content-Encoding expands to gigabytes. This requires the application to use the interceptors.decompress() interceptor against untrusted or compromised upstream servers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Uncaught Exception

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext ws:// where a MitM can alter the handshake.

Remediation

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Use of Persistent Cookies Containing Sensitive Information

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache() interceptor's shared-cache mode (type: 'shared'), which stores responses without excluding their Set-Cookie headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a Set-Cookie header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable Set-Cookie responses from a multi-user or untrusted upstream, and private caches are unaffected.

Workaround

This vulnerability can be avoided by running the cache interceptor in private mode (type: 'private'), so per-user Set-Cookie responses are not shared across callers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Uncaught Exception

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort() on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default unhandledRejection handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the WebSocketStream API while actively writing through a writer, and the server to be attacker-controlled or compromised.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Uncaught Exception

---

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners() on the zlib InflateRaw object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting Z_DATA_ERROR has no listener. This requires the application to use undici's WebSocket client or Node's bundled globalThis.WebSocket against an attacker-controlled or compromised WebSocket server.

Remediation

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Heap-based Buffer Overflow

---

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input.

Workaround

This vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: ["VipsForeignLoadHeif"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).

Remediation

Upgrade sharp to version 0.35.4 or higher.

References

• GitHub Release
• Maintainer's Advisory

---

CVE-2026-45447

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

There is no fixed version for Ubuntu:22.04 nodejs.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447
• https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
• https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
• https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
• https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
• https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
• https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
• https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
• https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
• https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
• https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
• https://openssl-library.org/news/secadv/20260609.txt
• https://access.redhat.com/errata/RHSA-2026:25237
• https://access.redhat.com/errata/RHSA-2026:25239
• https://access.redhat.com/errata/RHSA-2026:26275
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:34102
• https://access.redhat.com/errata/RHSA-2026:35869
• https://access.redhat.com/errata/RHSA-2026:36215
• https://access.redhat.com/errata/RHSA-2026:36217
• https://access.redhat.com/errata/RHSA-2026:39009
• https://access.redhat.com/errata/RHSA-2026:39012
• https://access.redhat.com/errata/RHSA-2026:39981
• https://access.redhat.com/security/cve/CVE-2026-45447
• https://bugzilla.redhat.com/show_bug.cgi?id=2481898
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json
• https://access.redhat.com/errata/RHSA-2026:44438
• https://access.redhat.com/errata/RHSA-2026:47735
• https://access.redhat.com/errata/RHSA-2026:47737
• https://access.redhat.com/errata/RHSA-2026:58563
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop through the customAlphabet and nanoid functions in nanoid/non-secure. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.

Notes

• The vulnerable code path is in the nanoid/non-secure entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.
• The denial-of-service only shows up when callers pass a negative size into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.

Remediation

Upgrade nanoid to version 3.3.16, 5.1.16 or higher.

References

• GitHub Commit

---

Integer Overflow or Wraparound

---

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound through the fillPool logic in index.js and index.cjs. An attacker can make subsequent ID generation deterministic by supplying an oversized size value to nanoid(size), which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.

Remediation

Upgrade nanoid to version 3.3.12, 5.1.11 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large !!omap sequence.

Remediation

Upgrade js-yaml to version 3.15.1, 4.3.1 or higher.

References

• GitHub Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (<<) handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments.

Note: This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.

Remediation

Upgrade js-yaml to version 3.15.2, 4.3.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.

Remediation

There is no fixed version for image-size.

References

• GitHub PR
• Vulnerability Report
• Vulnerable Code

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.

Remediation

There is no fixed version for image-size.

References

• GitHub PR
• Vulnerability Report
• Vulnerable Code

---

Directory Traversal

---

Overview

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Directory Traversal in the toSSG() static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that differ only in how they are rooted as equivalent. An attacker can cause build output to be written outside the intended output directory by supplying a route parameter with enough .. sequences that reaches ssgParams from an untrusted source.

Note: This affects build-time static site generation only, not request-time routing, and requires the application to build pages from ssgParams values sourced from untrusted origins such as a CMS, API, or user submissions.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-39408.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

Upgrade hono to version 4.13.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

---

HTTP Request Smuggling

---

Overview

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a ? appearing after a # as the start of the query string. An attacker can smuggle parameters past upstream allow/deny lists and validation, poison cache entries with unobserved parameters, or achieve stored XSS in cached HTML, by placing query parameters after a # fragment so browsers, new URL(), and reverse proxies ignore them while the query helpers still read them. This requires a literal # in the request URL to reach the application, and deployments behind intermediaries that strip fragments or runtimes that normalize URLs, such as Cloudflare Workers, are unaffected.

Remediation

Upgrade hono to version 4.13.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.

Remediation

Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict in resolve() through the resolve() process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.

Workarounds

• Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Handling of URL Encoding (Hex Encoding)

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as %2f%2fevil.example:/pwn, causing normalize() or resolve() to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Validation of Syntactic Correctness of Input

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6() and parseWithStatus() host-processing paths in lib/utils.js and index.js. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as http://[::not-valid]/private before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.

Workarounds

• Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri; this prevents malformed IPv6 text from being normalized into a different valid local or private address.
• Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Double Decoding of the Same Data

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize() and resolve() and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so %25 sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like localhost or a cloud metadata endpoint.

Workarounds

• Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve(). This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit v3.1.6
• Maintainer's Advisory

---

Improper Encoding or Escaping of Output

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but concatenates the port field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as @127.0.0.1:8124, which demotes the legitimate host to userinfo and yields http://trusted.example:@127.0.0.1:8124/app. This requires the application to build URIs from separate components and assign untrusted data directly to the port field of an object passed to serialize(), normalize(), or equal(), and ports obtained via parse() are unaffected because parsing validates digit-only values.

Remediation

Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Directory Traversal

---

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

There is no fixed version for extract-zip.

References

• Advisory
• GitHub Advisory

---

Directory Traversal

---

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in index.js. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running extract-zip.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

A fix was pushed into the master branch but not yet published.

References

• GitHub Commit
• GitHub PR

---

Prototype Pollution

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats() function in node.js. An attacker can crash the process or alter an object’s prototype by supplying a poisoned browserslist-stats.json file or untrusted stats data with inherited object-key names such as __proto__ or toString. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a TypeError on lookup or invoke the __proto__ setter during assignment, breaking any tool that calls browserslist() and causing a denial of service.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]
        

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory cache and parseCache in index.js. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique browserslist() result and parsed query AST to be retained indefinitely.

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---