@vercel/blob: raise undici floor to ^6.27.0 — dependency range overlaps CVE-2026-12151 (GHSA-vxpw-j846-p89q)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 595
- Forks
- 101
- Avg merge
- 2h 24m
- Merged PRs (30d)
- 1
Description
@vercel/blob (latest, 2.6.1) declares "undici": "^6.23.0". That range overlaps the version range affected by GHSA-vxpw-j846-p89q / CVE-2026-12151 (undici WebSocket client DoS via fragment-count bypass), so every app depending on @vercel/blob is flagged by npm/pnpm audit, Dependabot and any consumer whose lockfile resolved undici before 6.27.0 shipped (2026-06-15) is pinned to a vulnerable version until they intervene manually.
Please raise the floor to "undici": "^6.27.0" (the advisory's patched release).
Reproduction
$ npm view @vercel/blob@2.6.1 dependencies.undici
^6.23.0
# In a project that installed @vercel/blob before 2026-06-15:
$ npm ls undici
└─┬ @vercel/blob@2.5.0
└── undici@6.25.0 # affected by GHSA-vxpw-j846-p89q
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the @vercel/blob package manifest where the undici dependency is declared. Raise its minimum from ^6.23.0 to ^6.27.0, then install or audit the package to confirm the resolved undici version is no longer affected and the package remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100