Arkadiy Tetelman

**Name of the Vulnerable Software and Affected Versions** undici versions less than 5.7.1 **Description** The issue allows injecting CRLF sequences into request headers in undici, an HTTP/1.1 client for Node.js. This can be achieved by manipulating the `headers`, `path`, and `method` parameters. Sanitizing all HTTP headers from untrusted sources to eliminate `r ` is a potential workaround. A fix was released in version 5.8.0. **Recommendations** For versions less than 5.7.1, update to version 5.8.0 to resolve the issue. As a temporary workaround, consider sanitizing all HTTP headers from untrusted sources to eliminate `r ` until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Node.js versions prior to 6.15.0 Node.js versions prior to 8.14.0 **Description** The issue is related to HTTP request splitting, where Node.js can be tricked into using unsanitized user-provided Unicode data for the `path` option of an HTTP request. This can lead to a second, unexpected HTTP request being made to the same server. The vulnerability is also associated with errors in handling HTTP packets, which can allow a remote attacker to gain unauthorized access to protected data using HTTP requests. **Recommendations** For versions prior to 6.15.0, update to version 6.15.0 or later. For versions prior to 8.14.0, update to version 8.14.0 or later.

**Name of the Vulnerable Software and Affected Versions** Artifex Ghostscript versions prior to 9.26 **Description** An issue in Artifex Ghostscript is related to incorrect checking of LockSafetyParams when another device is used, which can allow a bypass of security restrictions. The vulnerability is associated with errors in the implementation of security checks for standard elements. **Recommendations** For Artifex Ghostscript versions prior to 9.26, update to version 9.26 or later to resolve the issue.