VDB
EN
MEDIUM 5.9

GHSA-g9mf-h72j-4rw9

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

상세

### Impact

The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

### Patches

Upgrade to 7.18.2 or 6.23.0.

### Workarounds

It is possible to apply an undici interceptor and filter long `Content-Encoding` sequences manually.

### References

* https://hackerone.com/reports/3456148 * https://github.com/advisories/GHSA-gm62-xv2j-4w53 * https://curl.se/docs/CVE-2022-32206.html

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / undici
최초 영향 버전: 7.0.0 수정 버전: 7.18.2
수정 npm install undici@7.18.2
npm / undici
최초 영향 버전: 0 수정 버전: 6.23.0
수정 npm install undici@6.23.0

참고