Mcollina

**اسم البرنامج المصاب والإصدارات المتأثرة** undici الإصدارات 6.5.0 through 6.29.0 undici الإصدارات 7.0.0 through 7.30.0 undici الإصدارات 8.0.0 through 8.12.1 **Description** يمكن دفع عميل EventSource في مكتبة عميل HTTP لـ Node.js هذه إلى استنفاد ذاكرة العملية بواسطة نظير Server-Sent Events خبيث. يحدث هذا عندما يقوم النظير بإرسال الملايين من حقول البيانات الصغيرة المكتملة بدون فاصل أحداث فارغ، أو سطر واحد غير مكتمل مقسم عبر العديد من الأجزاء (chunks). يحتفظ المحلل (parser) بكمية متزايدة من حالة كل حقل وكل جزء والتي لا تحدها قيود `maxEventSize` و `maxResponseSize`. وبما أن `maxResponseSize` يتم فرضه على الجسم المضغوط قبل فك الضغط، فإن استجابة مضغوطة صغيرة يمكن أن تتوسع إلى ذاكرة محتجزة كافية لإنهاء العملية. يؤثر هذا على التطبيقات التي تحافظ على اتصال EventSource بنظير غير موثوق، ويكون التأثير الوحيد هو توفر الخدمة. **Recommendations** تحديث الإصدارات 6.5.0 through 6.29.0 إلى 6.29.1 أو أحدث. تحديث الإصدارات 7.0.0 through 7.30.0 إلى 7.30.1 أو أحدث. تحديث الإصدارات 8.0.0 through 8.12.1 إلى 8.12.2 أو أحدث.

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

**اسم البرنامج المصاب والإصدارات المتأثرة** undici الإصدارات 6.23.0 through 6.29.0 undici الإصدارات 7.18.0 through 7.30.0 undici الإصدارات 8.0.0 through 8.12.1 **Description** يتسبب تنفيذ `fetch()` في تعطل عملية Node.js عندما يقوم خادم بعيد غير مصرح له بإرسال استجابة تحتوي على أكثر من خمسة ترميزات محتوى ويغلق الاتصال قبل إرسال الجسم. يحدث هذا لأن تدفق الاستجابة الداخلي يتم إنشاؤه قبل التحقق من حد ترميز المحتوى. وبما أن الطلب يتم إرجاعه دون إرفاق مستمع للأخطاء أو إلغاء الطلب، فإن الإغلاق المبكر يؤدي إلى عدم تطابق في طول المحتوى في التدفق اليتيم. يتعامل Node.js مع هذا كخطأ غير معالج، مما يؤدي إلى حجب الخدمة عن طريق إنهاء العملية، حتى لو قامت التطبيقات بالتقاط رفض `fetch()`. **Recommendations** تحديث الإصدارات 6.23.0 through 6.29.0 إلى 6.29.1 أو أحدث. تحديث الإصدارات 7.18.0 through 7.30.0 إلى 7.30.1 أو أحدث. تحديث الإصدارات 8.0.0 through 8.12.1 إلى 8.12.2 أو أحدث.

**اسم البرنامج المتأثر والإصدارات المتأثرة** undici الإصدارات من 8.11.0 إلى 8.11.1 **الوصف** يتعامل عميل WebSocket التجريبي في مكتبة عميل HTTP لـ Node.js بشكل خاطئ مع فشل مصافحة WebSocket عبر HTTP/2. نظرًا لأن الطلب يتم تمييزه على أنه مكتمل، تصبح عملية الإلغاء غير فعالة، مما يترك تدفق HTTP/2 الأساسي مفتوحًا بدون مستمع للأخطاء. يمكن لخادم بعيد غير مصرح له أن يتسبب في حجب الخدمة عن طريق تدمير الاتصال، مما يؤدي إلى إصدار التدفق اليتيم لخطأ غير معالج يتسبب في إغلاق عملية Node.js. **التوصيات** التحديث إلى الإصدار 8.11.2 أو أحدث. تعيين `allowH2` إلى false لتعطيل HTTP/2 لاتصالات WebSocket. تجنب فتح اتصالات WebSocket مع خوادم غير موثوقة.

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.

**اسم البرنامج المصاب والإصدارات المتأثرة** fastify الإصدارات من 5.12.2 إلى 5.12.5 **الوصف** يفشل الروتين المستخدم لتحويل أسماء الرؤوس (headers) المعلنة في مخطط المسار إلى أحرف صغيرة في تحويل أسماء رؤوس enum أو const المتداخلة داخل مخطط فرعي `propertyNames`. يؤدي ذلك إلى عدم تطابق قوائم السماح أو المنع الخاصة بالرؤوس المكتوبة بصيغة الحالة الأصلية (غير الصغيرة) مع الرؤوس الواردة بصيغة الأحرف الصغيرة، مما يسمح للرؤوس المقيدة بتجاوز التحقق والوصول إلى معالج المسار. يمكن للمهاجم استغلال ذلك لتهريب رؤوس محظورة، مما يؤثر على سلامة معالجة الطلبات. **التوصيات** التحديث إلى الإصدار 5.12.6 أو أحدث. تعريف أسماء الرؤوس بأحرف صغيرة لتجنب عدم التطابق.

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions prior to 12.7.0 **Description** Built-in HTTPS transports in this Fastify plugin override the secure default by setting `rejectUnauthorized` to false. This prevents the proxy from verifying the TLS certificate of the upstream server, even when configured for HTTPS. An on-path network attacker can impersonate the configured HTTPS upstream to read forwarded credentials and request bodies, or return forged responses that the application trusts. **Recommendations** Update to version 12.7.0 or later. As a temporary workaround, pass an explicit `rejectUnauthorized` true on the transport, supply an already configured undici instance, or use the undici global agent.

**Name of the Vulnerable Software and Affected Versions** @fastify/jwt versions prior to 10.2.3 **Description** In the @fastify/jwt plugin for the Fastify web framework, the parser fails to handle certain time span formats passed to `expiresIn`, `notBefore`, or `maxAge`. Unsupported formats include compound spans, month units, ISO 8601 durations, decimal commas, or values with surrounding whitespace. These values are silently dropped rather than refused. During the signing process, this results in tokens without an expiration claim that never expire. During the verification process, the configured `maxAge` is not enforced, allowing tokens that should be rejected due to age to be accepted. **Recommendations** Update to version 10.2.3 or later. Pass the `expiresIn`, `notBefore`, or `maxAge` options as a number of seconds. Verify that any time-span string parses to a finite value before use.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions prior to 10.1.4 **Description** On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or `allowedPath` restriction can be bypassed by altering the letter case of a path segment. This occurs because the route matcher is case-sensitive while the filesystem is not; a request with a modified case does not match the guarded route and is passed to the static handler, which the filesystem then resolves to the protected file. Consequently, unauthenticated requests can read files intended to be protected. This issue is not a directory traversal as it does not allow access to files outside the configured root, and it does not affect case-sensitive filesystems. **Recommendations** Update to version 10.1.4. Serve static files from a case-sensitive filesystem. Ensure route guards and `allowedPath` rules account for every letter-case variant of the protected paths.

**Name of the Vulnerable Software and Affected Versions** @fastify/proxy-addr versions 3.0.0 through 5.1.0 **Description** This plugin, used to determine a request's client address behind trusted reverse proxies, incorrectly handles trust subnets written in IPv4-mapped IPv6 notation when an IPv4-sized prefix is used (for example, ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104). The software accepts these inputs without error but ends up trusting every IPv4 address on the internet. This allows an unauthenticated client to provide an arbitrary `X-Forwarded-For` header to control the address the application reads, bypassing IP-based access control, rate limiting, geolocation, and audit logging. **Recommendations** Update to version 5.1.1 or later. Ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

**Name of the Vulnerable Software and Affected Versions** @fastify/auth versions 5.0.0 through 5.1.0 **Description** This plugin composes multiple authentication and authorization strategies into a single route guard. An issue exists when strategies are composed using the `relation` "or" option combined with the `run` "all" option, and one entry is a nested array acting as an AND group. In this scenario, the group is evaluated in an order-dependent manner where an earlier failing check is silently dropped, and the final result depends solely on the last check. This can lead to an authorization bypass where a request is authorized if it satisfies only the last member of an AND group. A similar order-dependent bypass occurs when the top-level `relation` is "and" and a nested group uses "or". **Recommendations** Update to version 5.1.1 or later. Omit the `run` "all" option where it is not required. Order each AND group so its stricter check is evaluated last. Replace nested AND groups with an explicit top-level "and" composition.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.5 **Description** When a route registers a response trailer using the `reply.trailer()` function and is served over HTTP/2, the framework unconditionally sets the Transfer-Encoding: chunked header. Because this header is forbidden in HTTP/2, Node.js throws an exception during the serialization of response headers. This exception is not caught, resulting in an uncaughtException that crashes the server process and drops all in-flight requests. A single unauthenticated HTTP/2 request to any route utilizing trailers can trigger this crash, which can be repeated after every server restart. **Recommendations** Update to version 5.12.5 or later. As a temporary workaround, avoid registering response trailers with the `reply.trailer()` function on routes served over HTTP/2.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 2.4.7 fast-uri versions 3.0.0 through 3.1.7 fast-uri versions 4.0.0 through 4.1.4 **Description** The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such as `%41`, decodes to a literal uppercase character that is not folded. In scheme-relative references (e.g., `//host`), the absence of a scheme prevents the host canonicalization that would typically correct this, causing the `parse`, `normalize`, and `equal` functions to disagree on the same host. Applications performing case-sensitive host decisions, such as those using an allowlist or denylist, can be bypassed using percent-encoded uppercase octets. Since DNS and HTTP hostnames are case-insensitive, the bypassed input still reaches the intended destination. **Recommendations** Update to version 2.4.7 or later. Update to version 3.1.8 or later. Update to version 4.1.5 or later. As a temporary workaround, compare hosts case-insensitively by lowercasing the parsed host before making any allowlist or denylist decisions.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions 4.1.3 through 4.1.4 **Description** The mailto parser compares query field names to reserved names such as `to`, `subject`, and `body` while they are still percent-encoded. Because the parser only decodes these names when storing them as generic headers, a percent-encoded version of a reserved field name is not recognized during the initial parse but is re-emitted as the literal field name during serialization. This desynchronization allows an attacker to smuggle a chosen recipient, subject, or body field across a roundtrip if an application validates the URI from the first parse and then serializes and sends it. **Recommendations** Update fast-uri to version 4.1.5 or later. As a temporary workaround, do not act on a mailto URI that has been re-serialized without first decoding and re-validating the `recipient`, `subject`, and `body` fields.

**Name of the Vulnerable Software and Affected Versions** fastify-cli versions 1.5.0 through 8.0.0 **Description** When a debug flag is used, the software starts the Node.js Inspector but ignores the explicit bind address provided by the user. Instead of binding to the intended loopback address, it binds to a broadly reachable address, exposing the debugging interface beyond the local machine. Since the Inspector protocol allows arbitrary code evaluation, a remote party with access to this interface can achieve remote code execution on the developer's machine. **Recommendations** Upgrade to fastify-cli version 8.0.1.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.3 **Description** A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows a request using an absolute-form target to reach the route handler while skipping path-scoped middleware used for authentication, authorization, rate limiting, or auditing. An unauthenticated network attacker can exploit this behavior to bypass path-based access controls. **Recommendations** Update @fastify/middie to version 9.3.4 or later. As a workaround, enforce authentication using a Fastify hook such as `preHandler()`.