undici vulnerable to CRLF Injection via blob-like body 'type' property

Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher via request, stream, pipeline, or dispatch with a .type derived from untrusted input, an attacker can inject CRLF sequences \r\n to append arbitrary HTTP headers and potentially smuggle a second request...

undici: undici: Denial of Service via crafted WebSocket frame with large length

A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici's ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primar...

nodejs and nodejs-nodemon security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform for building fast a...