Security vulnerability affects the langfuse package. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.