Potential Vulnerabilities in undici npm Package
The undici npm package is reportedly affected by two issues: shared-cache disclosure and a parse-time crash due to malformed private cache directives. Users of affected versions should monitor for updates.
What happened
An early warning has been issued regarding potential vulnerabilities in the undici npm package. The issues, tracked under GHSA-4CWX-7WF7-3272, involve a shared-cache disclosure and a parse-time crash caused by malformed private cache directives. These vulnerabilities appear to affect multiple versions of the package.
The shared-cache disclosure issue could potentially allow cross-user information disclosure, while the parse-time crash may lead to application instability. The vulnerabilities are under investigation, and specific details about exploitation or real-world impact are not yet confirmed.
Affected versions include various ranges introduced from version 0 up to specific fixed versions as listed in the threat data. It is recommended that users monitor the undici package for updates and apply fixes as soon as they become available. For the most accurate and up-to-date information, consult the primary sources provided.
How 0Day mitigates this
undici is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.