Snyk test report

Allocation of Resources Without Limits or Throttling

Overview

zod is a TypeScript-first schema declaration and validation library with static type inference

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Remediation

Upgrade zod to version 4.6.6 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Issue
• GitHub PR

Infinite loop

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to removeDotSegments directly, or through the normalize or resolve functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.

Remediation

There is no fixed version for uri-js.

References

• GitHub Issue
• Vulnerable Code
• Vulnerable Code

Improper Handling of Case Sensitivity

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch() implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as SHA256-... or Sha256-... is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.

Note: This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., SHA256, Sha384) in its integrity metadata rather than the canonical lowercase forms.

Workaround

Use lowercase algorithm tokens (sha256, sha384, sha512) in all integrity metadata passed to fetch().

Remediation

Upgrade undici to version 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Uncaught Exception

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERR_TLS_CERT_ALTNAME_INVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed assert call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Allocation of Resources Without Limits or Throttling

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Uncaught Exception

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or onResponseEnd propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.

Remediation

Upgrade undici to version 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Allocation of Resources Without Limits or Throttling

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is only enforced inside parseLine(), which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a data: field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Uncaught Exception

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning a response with more than five content-encoding layers triggers an error path that previously called reject() before the response body Readable stream was initialised, leaving the stream in an inconsistent state and crashing the client process.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

• GitHub Advisory
• Vendor Advisory

Use After Free

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Use After Free in entity_insert() and the entity map held on XmlState, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its Drop implementation calls xmlFreeNode() while the outer xmlCtxtParseEntity() is still using that 144 byte xmlEntity. An attacker can corrupt process memory by supplying an SVG document whose xi:include pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.

Remediation

Upgrade sharp to version 0.35.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitLab Work Item
• Red Hat Bugzilla Bug
• RustSec Advisory
• PoC in GitHub

Heap-based Buffer Overflow

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input.

Workaround

This vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: ["VipsForeignLoadHeif"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).

Remediation

Upgrade sharp to version 0.35.4 or higher.

References

• GitHub Release
• Maintainer's Advisory

Uncaught Exception

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as produced by JSON.parse, or by qs.parse under allowPrototypes or plainObjects (which yields null-prototype objects) - cause Array.prototype.join or utils.encode to throw a TypeError: Cannot convert object to primitive value, crashing the process.

Note: This is only exploitable if the arrayFormat: 'comma' option is explicitly set.

Remediation

Upgrade qs to version 6.16.1 or higher.

References

• GitHub Advisory
• GitHub Commit

Regular Expression Denial of Service (ReDoS)