conductor-oss / conductor-oss/javascript-sdk
[GHSA-g9mf-h72j-4rw9] undici@7.16.0: Unbounded decompression chain
- Vorherrschende Sprache
- TypeScript
- Sterne
- 58
- Forks
- 20
- Ø Merge
- 1 T. 13 Std.
- Gemergte PRs (30 T.)
- 7
Beschreibung
## Vulnerability Report
| CVE | Library | Installed | Fixed |
|-----|---------|-----------|-------|
| GHSA-g9mf-h72j-4rw9 | undici | 7.16.0 | 6.23.0 |
### Summary
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API.
### References
- [GHSA-g9mf-h72j-4rw9](https://osv.dev/vulnerability/GHSA-g9mf-h72j-4rw9)
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Rechercherichtung
No file, test, or entry point is named. Start by locating the dependency manifest and lockfile entries for undici 7.16.0, then verify the available fixed version against the advisory; done should mean the dependency is no longer reported as vulnerable and the existing checks pass.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- node.js, typescript
- Bereich
- backend, security
- Issue-Typ
- Bug
- Schwierigkeit
- 2/5
- Geschätzter Aufwand
- 1-3 Stunden
- Aktivitätsstatus
- Veraltet
- Klarheit
- Muss geklärt werden
- Anfängerfreundlichkeit
- 35/100