undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.

Affected: npm: undici

### Impact

`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.

If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`

```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ```

Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.

If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

### Patches

This issue was fixed in `undici@5.8.1`.

### Workarounds

The best workaround is to validate user input before passing it to the `undici.request` call.

## For more information If you have any questions or comments about this advisory:

- Open an issue in [undici repository](https://github.com/nodejs/undici/issues) - To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document

corepack16-16.17.0-2.1 on GA media

search-api: SQL injection leads to remote denial of service terser: insecure use of regular expressions leads to ReDoS moment: inefficient parsing algorithm resulting in DoS nodejs: undici vulnerable to CRLF via content headers nodejs: undici.request vulnerable to SSRF

Security update for nodejs16

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service oder nicht spezifizierten Angriff durchzuführen.