https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:49:30 +0000 https://vulnerability.circl.lu/vuln/ghsa-g9mf-h72j-4rw9 <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.</p> <p>However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.</p> <p>### Patches</p> <p>Upgrade to 7.18.2 or 6.23.0.</p> <p>### Workarounds</p> <p>It is possible to apply an undici interceptor and filter long `Content-Encoding` sequences manually.</p> <p>### References</p> <p>* https://hackerone.com/reports/3456148 * https://github.com/advisories/GHSA-gm62-xv2j-4w53 * https://curl.se/docs/CVE-2022-32206.html</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.</p> <p>However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.</p> <p>### Patches</p> <p>Upgrade to 7.18.2 or 6.23.0.</p> <p>### Workarounds</p> <p>It is possible to apply an undici interceptor and filter long `Content-Encoding` sequences manually.</p> <p>### References</p> <p>* https://hackerone.com/reports/3456148 * https://github.com/advisories/GHSA-gm62-xv2j-4w53 * https://curl.se/docs/CVE-2022-32206.html</p> https://vulnerability.circl.lu/vuln/ghsa-g9mf-h72j-4rw9