-
Notifications
You must be signed in to change notification settings - Fork 66
Open
Description
Hello,
I received the following message today when updating node packages on a project:
undici <6.23.0
Severity: moderate
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - https://github.com/advisories/GHSA-g9mf-h72j-4rw9
fix available via `npm audit fix --force`
Will install next-video@0.0.1, which is a breaking change
node_modules/undici
@vercel/blob 0.0.3 - 2.0.0 || 2.1.0-062a059-20260128141057 - 2.1.0-39df1d8-20260121161119
Depends on vulnerable versions of undici
node_modules/@vercel/blob
next-video >=0.5.0
Depends on vulnerable versions of @vercel/blob
Depends on vulnerable versions of undici
node_modules/next-video
3 moderate severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --forceI believe that updating the @vercel/blob package to the latest point release (from v2.0.0 to v2.0.1) will fix this issue. It looks like the folks managing @vercel/blob have already patched the vulnerability in Undici.
Thanks for you time :)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels