| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| undici | ≥ 7.0.0, < 7.18.2< 6.23.0 | 7.18.26.23.0 |
| undici | ≥ 7.0.0, < 7.18.2< 6.23.0 | 7.18.26.23.0 |
The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.
However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.
Upgrade to 7.18.2 or 6.23.0.
It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン