Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nodejs/undici
main @ 01444a1
46
Fixes
19
CVEs
HIGH
Peak severity
35.9%
Coverage
Highlights
Information Disclosure: 16 prior fixes. Scrutinize any change in this area.
lib/core/request.js: most-fixed (6 issues). Treat as high-risk during review.
15 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
HTTP Request Smuggling: The client request pipeline has recurrently failed to sanitize carriage return and line feed (CRLF) characters, as well as handle duplicate Content-Length and Host headers, leaving the parser highly susceptible to request and protocol smuggling.
Information Disclosure: Cross-origin redirects have persistently failed to strip sensitive authorization, proxy, and cookie headers, particularly when request headers are instantiated as Map or standard Headers objects rather than raw options.
Denial of Service: Unbounded resource allocation during decompression and missing frame limits in the WebSocket permessage-deflate integration can trigger process memory exhaustion and crashes.