Krsecu

**Name of the Vulnerable Software and Affected Versions** undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1 **Description** A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including the error listener, while the stream remains active. If a remote peer sends a compressed payload that exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, the inflate stream emits a data error. Because no listener is attached, Node.js treats this as a fatal unhandled error and terminates the process. This allows for a remote, unauthenticated Denial of Service (DoS) attack where a small amount of data (approximately 130 KB) can crash the process. **Recommendations** Upgrade to version 6.28.1 Upgrade to version 7.29.1 Upgrade to version 8.10.2

**Name of the Vulnerable Software and Affected Versions** Jupyter Server versions prior to 2.11.2 **Description** The Jupyter Server has an issue related to unhandled errors in API requests coming from an authenticated user, which can include traceback information and path information. Since the requesting user already has arbitrary execution permissions in the same environment, the revealed paths are not considered particularly sensitive. There is no known mechanism to trigger these errors without authentication. **Recommendations** For versions prior to 2.11.2, upgrade to version 2.11.2 or later, which includes a fix that no longer includes traceback information in JSON error responses. As a temporary workaround, consider restricting access to sensitive paths and information, but note that there are no known workarounds for this issue.