Yanhaoxi

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During an unclean close, the internal socket-close handler calls abort on the writable stream and discards the returned promise. According to the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError. Since the application holds a writer on that writable, the rejection is not observed, triggering Node's default unhandled-rejection behavior which terminates the process. This allows an untrusted server to cause a Denial of Service by abruptly disconnecting. **Recommendations** Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.