Ulisesgascon

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML method on any value that has a truthy toHTML, so such a value throws a TypeError, and because the async substitution runs on a later tick outside the render function's try/catch, the throw is an uncaught exception that terminates the process without sending a response. Only version 4.3.0 is affected, since the throwing escape was introduced by the fix for CVE-2026-16231 and earlier versions do not escape async helper values. It can be triggered remotely when an async helper resolves to an externally influenced object such as parsed JSON. The issue is fixed in hbs 4.3.1, and users should upgrade to hbs 4.3.1 or later.

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.7.0 through 6.28.0 undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The WebSocket client crashes the Node.js process during the opening handshake if a server responds with a subprotocol that the client did not request. When a server's 101 response includes a `Sec-WebSocket-Protocol` header, the client dereferences a null value while validating it against the requested list, triggering an uncaught `TypeError`. Since this occurs within a microtask lacking error handling, the exception terminates the process. This allows a remote attacker controlling a server or performing a machine-in-the-middle attack on a plaintext connection to cause a Denial of Service without authentication. **Recommendations** Upgrade to version 6.28.1 for installations using the 6.x branch. Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.3 **Description** A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows a request using an absolute-form target to reach the route handler while skipping path-scoped middleware used for authentication, authorization, rate limiting, or auditing. An unauthenticated network attacker can exploit this behavior to bypass path-based access controls. **Recommendations** Update @fastify/middie to version 9.3.4 or later. As a workaround, enforce authentication using a Fastify hook such as `preHandler()`.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.15.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The decompress interceptor decompresses response bodies based on the untrusted `Content-Encoding` header. Although the number of encoding layers is capped, the total decompressed output size is unbounded and lacks a configuration limit. A malicious upstream server can send a compression bomb—a small compressed payload that expands to hundreds of megabytes or more in client memory—leading to asymmetric resource consumption that can exhaust memory and crash the process, resulting in a Denial of Service (DoS). **Recommendations** Update undici versions 7.15.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During an unclean close, the internal socket-close handler calls abort on the writable stream and discards the returned promise. According to the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError. Since the application holds a writer on that writable, the rejection is not observed, triggering Node's default unhandled-rejection behavior which terminates the process. This allows an untrusted server to cause a Denial of Service by abruptly disconnecting. **Recommendations** Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1 **Description** A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including the error listener, while the stream remains active. If a remote peer sends a compressed payload that exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, the inflate stream emits a data error. Because no listener is attached, Node.js treats this as a fatal unhandled error and terminates the process. This allows for a remote, unauthenticated Denial of Service (DoS) attack where a small amount of data (approximately 130 KB) can crash the process. **Recommendations** Upgrade to version 6.28.1 Upgrade to version 7.29.1 Upgrade to version 8.10.2

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing property keys and the root-level required array, but it fails to lowercase the trigger and dependent names within the JSON Schema Draft 7 dependencies keyword. Since Node.js stores request header names in lowercase, dependencies using canonical-case names never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a header that activates a privileged branch while omitting a required header, thereby bypassing conditional checks. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named `value` at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions 4.0.0 through 5.12.1 **Description** An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.11.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The retry handler can leave a response body pending indefinitely. This occurs when a server provides a successful response with a `Content-Length` but closes the connection after sending only part of the body. If a subsequent retry returns a non-retryable status (such as 400), the handler forwards the new response and replaces the internal response stream, leaving the original response body held by the application neither ended nor destroyed. Consequently, calls reading that body never settle, and the body timeout fails to trigger because the timer is linked to the connection parser rather than the orphaned body. An attacker-controlled server can exploit this by sending two short responses to accumulate pending promises and streams, potentially exhausting application memory or concurrency, leading to a Denial of Service (DoS), which is a condition where a service is unavailable to its intended users. **Recommendations** Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 8.10.0 through 8.10.1 **Description** When the cache or deduplicate interceptor is composed directly onto a Client or Pool, the destination origin is omitted from the cache and request-deduplication keys. This causes the internal cache key to fall back to an empty origin string, allowing a response from one upstream origin to be returned for a request to a different trusted origin if the method, path, and relevant headers match. This leads to cross-origin information disclosure and persistent cache poisoning. A demonstrated impact includes a full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without the trusted origin being contacted. **Recommendations** Upgrade to undici version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The cache interceptor fails to handle the `Set-Cookie` response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheable response contains a `Set-Cookie` header, such as those with public and max-age directives. Consequently, a cookie belonging to one user may be disclosed to another user, or an untrusted server could inject cookies into cached responses served to subsequent callers, violating the requirement that shared caches must not store cookies. **Recommendations** Update undici versions 7.0.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.28.1 undici versions 7.0.0 through 7.29.1 undici versions 8.0.0 through 8.10.2 **Description** The retry interceptor can append the body of a ranged retry response to bytes already delivered from a previous partial response while maintaining the original response status and headers. This occurs when an upstream server provides part of a body without a trustworthy resume checkpoint—such as a non-success response with already sent headers or a partial-content response with an unusable content range—closes the connection, and then provides more bytes in the resumed range request. Consequently, the response body may exceed the `Content-Length` observed by the application. If an application relays this response to a downstream HTTP/1.1 peer without normalizing the framing, the excess bytes may be interpreted as the start of a subsequent response, leading to downstream response splitting or desynchronization. This requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. **Recommendations** Update to version 6.28.1 for versions prior to 6.28.1. Update to version 7.29.1 for versions 7.0.0 through 7.29.1. Update to version 8.10.2 for versions 8.0.0 through 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The cache interceptor incorrectly handles the caching of unsafe HTTP methods. While documentation states only safe methods are cached, the logic used to skip caching fails to include unsafe methods like POST, PUT, or DELETE in the skip list. Consequently, these requests enter the cache-read path. Additionally, the response-storage gate does not verify the HTTP method, allowing responses to unsafe requests that are heuristically cacheable or contain a Cache-Control directive to be stored. This allows a remote origin to provide a cacheable response that the client will later replay for subsequent state-changing requests, preventing them from reaching the origin and causing an integrity failure. **Recommendations** Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.24.1 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The `BalancedPool` constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support functions, any function-valued TLS options, such as a custom `checkServerIdentity` callback or a custom connector within the `connect` option, are silently discarded. This can lead to a TLS certificate validation bypass where a peer that should be rejected by a custom `checkServerIdentity` function is accepted if it passes the default Node.js hostname and chain checks. **Recommendations** Update undici versions 7.24.1 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.