FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: update undici to 8.2.0 · nodejs/node@94ac62a · GitHub

deps: update undici to 8.2.0 · nodejs/node@94ac62a · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 94ac62a

Browse files
nodejs-github-bot
authored and
aduh95
committed
deps: update undici to 8.2.0
PR-URL: #63092 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent 9afb013 commit 94ac62a

58 files changed

Lines changed: 2036 additions & 989 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/undici/src/.gitignore‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,6 @@ typings/
6060
# next.js build output
6161
.next
6262

63-
# lock files
64-
package-lock.json
65-
yarn.lock
66-
pnpm-lock.yaml
67-
6863
# IDE files
6964
.idea
7065
.vscode
@@ -81,9 +76,6 @@ fuzz-results-*.json
8176
undici-fetch.js
8277
/test/imports/undici-import.js
8378

84-
# .npmrc has platform specific value for windows
85-
.npmrc
86-
8779
.tap
8880

8981
# File generated by /test/request-timeout.js

‎deps/undici/src/.npmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
min-release-age=1

‎deps/undici/src/SECURITY.md‎

Lines changed: 161 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,161 @@
1-
If you believe you have found a security issue in the software in this
2-
repository, please consult https://github.com/nodejs/node/blob/HEAD/SECURITY.md.
1+
# Security
2+
3+
## Reporting a vulnerability in undici
4+
5+
Report security bugs in undici via
6+
[GitHub Security Advisories](https://github.com/nodejs/undici/security/advisories/new)
7+
or [HackerOne](https://hackerone.com/nodejs).
8+
9+
Your report will normally be acknowledged within 5 days, and you will receive
10+
a more detailed response within 10 days indicating the next steps in handling
11+
your submission. These timelines may extend when our triage volunteers are
12+
away, particularly at the end of the year.
13+
14+
After the initial reply to your report, the security team will endeavor to keep
15+
you informed of the progress being made towards a fix and full announcement,
16+
and may ask for additional information or guidance surrounding the reported
17+
issue.
18+
19+
## Disclosure policy
20+
21+
* The security report is received and assigned a primary handler. The problem
22+
is validated against all supported versions of undici. Once confirmed, a list
23+
of all affected versions is determined. Code is audited to find any potential
24+
similar problems. Fixes are prepared for all supported releases. These fixes
25+
are not committed to the public repository but rather held locally pending
26+
the announcement.
27+
28+
* Because undici is bundled into Node.js, security releases are often
29+
coordinated with the Node.js project to avoid leaving Node.js users
30+
vulnerable. As a result, fixed versions of undici are published to npm
31+
before the corresponding CVE is disclosed, since the CVE will only be
32+
published after the coordinated Node.js release. This delay is typically
33+
a few days but can take up to a week.
34+
35+
## The undici threat model
36+
37+
Undici is an HTTP client library for Node.js. Its threat model is derived from
38+
and aligned with the [Node.js threat model](https://github.com/nodejs/node/blob/HEAD/SECURITY.md#the-nodejs-threat-model).
39+
40+
### What constitutes a vulnerability
41+
42+
Being able to cause the following through control of the elements that undici
43+
does not trust is considered a vulnerability:
44+
45+
* Disclosure or loss of integrity or confidentiality of data protected through
46+
the correct use of undici APIs.
47+
* The unavailability of the runtime, including the unbounded degradation of its
48+
performance.
49+
50+
#### Denial of Service (DoS) vulnerabilities
51+
52+
For a behavior to be considered a DoS vulnerability, the proof of concept must
53+
meet the following criteria:
54+
55+
* The API is being correctly used.
56+
* The API is public and documented.
57+
* The behavior is significant enough to cause a denial of service quickly
58+
or in a context not controlled by the application developer (for example,
59+
HTTP parsing).
60+
* The behavior is directly exploitable by an untrusted source without requiring
61+
application mistakes.
62+
* The behavior cannot be reasonably mitigated through standard operational
63+
practices (like process recycling).
64+
* The attack demonstrates
65+
[asymmetric resource consumption](https://cwe.mitre.org/data/definitions/405.html),
66+
where the attacker expends significantly fewer resources than what is required
67+
by the client to process the attack.
68+
69+
**Undici does NOT trust**:
70+
71+
* Data received from the remote end of HTTP connections (both inbound responses
72+
and server-sent data) that is parsed or transformed by undici before being
73+
passed to the application. This includes:
74+
* HTTP response headers and status lines.
75+
* HTTP response bodies when processed by undici (e.g., chunked transfer
76+
decoding, content-encoding).
77+
* WebSocket frames received from a server.
78+
* Server-Sent Events (EventSource) data received from a server.
79+
* TLS certificate validation performed by undici on behalf of the application.
80+
81+
**Undici trusts**:
82+
83+
* The application code that uses its APIs, including all configuration,
84+
options, and callbacks provided by the application.
85+
* The operating system and its network stack.
86+
* The Node.js runtime undici is running on.
87+
* Dependencies installed by the application.
88+
* The DNS resolution results provided by the operating system or configured
89+
resolvers.
90+
91+
In other words, if untrusted data passing through undici to the application
92+
can trigger actions other than those documented for the APIs, there is likely
93+
a security vulnerability. Examples of unwanted actions are polluting globals,
94+
causing an unrecoverable crash, or any other unexpected side effects that can
95+
lead to a loss of confidentiality, integrity, or availability.
96+
97+
### Examples of vulnerabilities
98+
99+
#### Improper Certificate Validation (CWE-295)
100+
101+
* Undici provides TLS connections to HTTPS endpoints. If certificates can be
102+
crafted that result in incorrect validation by undici, that is considered
103+
a vulnerability.
104+
105+
#### Inconsistent Interpretation of HTTP Responses (CWE-444)
106+
107+
* Undici parses HTTP responses received from servers. Bugs in parsing response
108+
headers or transfer encoding which can result in response smuggling or
109+
desynchronization are considered vulnerabilities.
110+
111+
#### HTTP Request Smuggling (CWE-444)
112+
113+
* Bugs that allow crafting requests that are interpreted differently by undici
114+
and an upstream server, leading to request smuggling, are considered
115+
vulnerabilities.
116+
117+
#### CRLF Injection in Request Headers (CWE-93)
118+
119+
* If untrusted input passed to undici APIs (such as header values or URLs)
120+
can inject additional headers or corrupt the HTTP request stream, that is
121+
considered a vulnerability.
122+
123+
### Examples of non-vulnerabilities
124+
125+
#### Malicious Third-Party Modules (CWE-1357)
126+
127+
* Application code and its dependencies are trusted by undici. Any scenario
128+
that requires a malicious third-party module cannot result in a vulnerability
129+
in undici.
130+
131+
#### Prototype Pollution Attacks (CWE-1321)
132+
133+
* Undici trusts the inputs provided to it by application code. It is up to the
134+
application to sanitize appropriately. Any scenario that requires control
135+
over user input passed directly by the application is not considered a
136+
vulnerability in undici.
137+
138+
#### Uncontrolled Resource Consumption on Outbound Connections (CWE-400)
139+
140+
* If undici is asked to connect to a remote site and the response payload is
141+
large enough to impact performance or cause the runtime to run out of
142+
resources, that is not considered a vulnerability. Applications are
143+
responsible for setting appropriate limits on response sizes.
144+
145+
#### Application Misconfiguration
146+
147+
* Issues arising from incorrect or insecure use of undici APIs (such as
148+
disabling TLS verification, ignoring errors, or passing unsanitized user
149+
input to request options) are the application's responsibility, not
150+
vulnerabilities in undici.
151+
152+
## Receiving security updates
153+
154+
Security notifications will be distributed via
155+
[GitHub Security Advisories](https://github.com/nodejs/undici/security/advisories).
156+
157+
## Comments on this policy
158+
159+
If you have suggestions on how this process could be improved, please open an
160+
issue on the [nodejs/undici](https://github.com/nodejs/undici/issues)
161+
repository or file a pull request.

‎deps/undici/src/deps/llhttp/include/llhttp.h‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
#define LLHTTP_VERSION_MAJOR 9
66
#define LLHTTP_VERSION_MINOR 3
7-
#define LLHTTP_VERSION_PATCH 0
7+
#define LLHTTP_VERSION_PATCH 1
88

99
#ifndef INCLUDE_LLHTTP_ITSELF_H_
1010
#define INCLUDE_LLHTTP_ITSELF_H_
@@ -58,10 +58,8 @@ enum llhttp_errno {
5858
HPE_OK = 0,
5959
HPE_INTERNAL = 1,
6060
HPE_STRICT = 2,
61-
HPE_CR_EXPECTED = 25,
6261
HPE_LF_EXPECTED = 3,
6362
HPE_UNEXPECTED_CONTENT_LENGTH = 4,
64-
HPE_UNEXPECTED_SPACE = 30,
6563
HPE_CLOSED_CONNECTION = 5,
6664
HPE_INVALID_METHOD = 6,
6765
HPE_INVALID_URL = 7,
@@ -82,15 +80,17 @@ enum llhttp_errno {
8280
HPE_PAUSED_UPGRADE = 22,
8381
HPE_PAUSED_H2_UPGRADE = 23,
8482
HPE_USER = 24,
83+
HPE_CR_EXPECTED = 25,
8584
HPE_CB_URL_COMPLETE = 26,
8685
HPE_CB_STATUS_COMPLETE = 27,
87-
HPE_CB_METHOD_COMPLETE = 32,
88-
HPE_CB_VERSION_COMPLETE = 33,
8986
HPE_CB_HEADER_FIELD_COMPLETE = 28,
9087
HPE_CB_HEADER_VALUE_COMPLETE = 29,
88+
HPE_UNEXPECTED_SPACE = 30,
89+
HPE_CB_RESET = 31,
90+
HPE_CB_METHOD_COMPLETE = 32,
91+
HPE_CB_VERSION_COMPLETE = 33,
9192
HPE_CB_CHUNK_EXTENSION_NAME_COMPLETE = 34,
9293
HPE_CB_CHUNK_EXTENSION_VALUE_COMPLETE = 35,
93-
HPE_CB_RESET = 31,
9494
HPE_CB_PROTOCOL_COMPLETE = 38
9595
};
9696
typedef enum llhttp_errno llhttp_errno_t;
@@ -294,10 +294,8 @@ typedef enum llhttp_status llhttp_status_t;
294294
XX(0, OK, OK) \
295295
XX(1, INTERNAL, INTERNAL) \
296296
XX(2, STRICT, STRICT) \
297-
XX(25, CR_EXPECTED, CR_EXPECTED) \
298297
XX(3, LF_EXPECTED, LF_EXPECTED) \
299298
XX(4, UNEXPECTED_CONTENT_LENGTH, UNEXPECTED_CONTENT_LENGTH) \
300-
XX(30, UNEXPECTED_SPACE, UNEXPECTED_SPACE) \
301299
XX(5, CLOSED_CONNECTION, CLOSED_CONNECTION) \
302300
XX(6, INVALID_METHOD, INVALID_METHOD) \
303301
XX(7, INVALID_URL, INVALID_URL) \
@@ -318,15 +316,17 @@ typedef enum llhttp_status llhttp_status_t;
318316
XX(22, PAUSED_UPGRADE, PAUSED_UPGRADE) \
319317
XX(23, PAUSED_H2_UPGRADE, PAUSED_H2_UPGRADE) \
320318
XX(24, USER, USER) \
319+
XX(25, CR_EXPECTED, CR_EXPECTED) \
321320
XX(26, CB_URL_COMPLETE, CB_URL_COMPLETE) \
322321
XX(27, CB_STATUS_COMPLETE, CB_STATUS_COMPLETE) \
323-
XX(32, CB_METHOD_COMPLETE, CB_METHOD_COMPLETE) \
324-
XX(33, CB_VERSION_COMPLETE, CB_VERSION_COMPLETE) \
325322
XX(28, CB_HEADER_FIELD_COMPLETE, CB_HEADER_FIELD_COMPLETE) \
326323
XX(29, CB_HEADER_VALUE_COMPLETE, CB_HEADER_VALUE_COMPLETE) \
324+
XX(30, UNEXPECTED_SPACE, UNEXPECTED_SPACE) \
325+
XX(31, CB_RESET, CB_RESET) \
326+
XX(32, CB_METHOD_COMPLETE, CB_METHOD_COMPLETE) \
327+
XX(33, CB_VERSION_COMPLETE, CB_VERSION_COMPLETE) \
327328
XX(34, CB_CHUNK_EXTENSION_NAME_COMPLETE, CB_CHUNK_EXTENSION_NAME_COMPLETE) \
328329
XX(35, CB_CHUNK_EXTENSION_VALUE_COMPLETE, CB_CHUNK_EXTENSION_VALUE_COMPLETE) \
329-
XX(31, CB_RESET, CB_RESET) \
330330
XX(38, CB_PROTOCOL_COMPLETE, CB_PROTOCOL_COMPLETE) \
331331

332332

‎deps/undici/src/deps/llhttp/src/llhttp.c‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#endif /* _MSC_VER */
1111
#endif /* __SSE4_2__ */
1212

13-
#ifdef __ARM_NEON__
13+
#if defined(__ARM_NEON__) || defined(__ARM_NEON)
1414
#include <arm_neon.h>
1515
#endif /* __ARM_NEON__ */
1616

@@ -1542,7 +1542,7 @@ static llparse_state_t llhttp__internal__run(
15421542
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
15431543
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 1, 1, 1,
15441544
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1545-
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1545+
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0,
15461546
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
15471547
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
15481548
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -2625,7 +2625,7 @@ static llparse_state_t llhttp__internal__run(
26252625
goto s_n_llhttp__internal__n_header_value_otherwise;
26262626
}
26272627
#endif /* __SSE4_2__ */
2628-
#ifdef __ARM_NEON__
2628+
#if defined(__ARM_NEON__) || defined(__ARM_NEON)
26292629
while (endp - p >= 16) {
26302630
uint8x16_t input;
26312631
uint8x16_t single;
@@ -2639,19 +2639,23 @@ static llparse_state_t llhttp__internal__run(
26392639
/* Find first character that does not match `ranges` */
26402640
single = vceqq_u8(input, vdupq_n_u8(0x9));
26412641
mask = single;
2642-
single = vandq_u16(
2642+
single = vandq_u8(
26432643
vcgeq_u8(input, vdupq_n_u8(' ')),
26442644
vcleq_u8(input, vdupq_n_u8('~'))
26452645
);
2646-
mask = vorrq_u16(mask, single);
2647-
single = vandq_u16(
2646+
mask = vorrq_u8(mask, single);
2647+
single = vandq_u8(
26482648
vcgeq_u8(input, vdupq_n_u8(0x80)),
26492649
vcleq_u8(input, vdupq_n_u8(0xff))
26502650
);
2651-
mask = vorrq_u16(mask, single);
2652-
narrow = vshrn_n_u16(mask, 4);
2651+
mask = vorrq_u8(mask, single);
2652+
narrow = vshrn_n_u16(vreinterpretq_u16_u8(mask), 4);
26532653
match_mask = ~vget_lane_u64(vreinterpret_u64_u8(narrow), 0);
2654-
match_len = __builtin_ctzll(match_mask) >> 2;
2654+
if (match_mask == 0) {
2655+
match_len = 16;
2656+
} else {
2657+
match_len = __builtin_ctzll(match_mask) >> 2;
2658+
}
26552659
if (match_len != 16) {
26562660
p += match_len;
26572661
goto s_n_llhttp__internal__n_header_value_otherwise;

‎deps/undici/src/docs/docs/api/Dispatcher.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1354,10 +1354,10 @@ Emitted when dispatcher is no longer busy.
13541354

13551355
## Parameter: `UndiciHeaders`
13561356

1357-
* `Record<string, string | string[] | undefined> | string[] | Iterable<[string, string | string[] | undefined]> | null`
1357+
* `Record<string, number | string | string[] | undefined> | string[] | Iterable<[string, string | string[] | undefined]> | null`
13581358

13591359
Header arguments such as `options.headers` in [`Client.dispatch`](/docs/docs/api/Client.md#clientdispatchoptions-handlers) can be specified in three forms:
1360-
* As an object specified by the `Record<string, string | string[] | undefined>` (`IncomingHttpHeaders`) type.
1360+
* As an object specified by the `Record<string, number | string | string[] | undefined>` (`OutgoingHttpHeaders`) type.
13611361
* As an array of strings. An array representation of a header list must have an even length, or an `InvalidArgumentError` will be thrown.
13621362
* As an iterable that can encompass `Headers`, `Map`, or a custom iterator returning key-value pairs.
13631363
Keys are lowercase and values are not modified.

‎deps/undici/src/lib/api/api-connect.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ class ConnectHandler extends AsyncResource {
6060
// Indicates is an HTTP2Session
6161
if (responseHeaders != null) {
6262
responseHeaders = this.responseHeaders === 'raw'
63-
? (Array.isArray(rawHeaders) ? util.parseRawHeaders(rawHeaders) : [])
63+
? util.parseRawHeaders(rawHeaders)
6464
: headers
6565
}
6666

‎deps/undici/src/lib/api/api-pipeline.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ class PipelineHandler extends AsyncResource {
167167
if (this.onInfo) {
168168
const rawHeaders = controller?.rawHeaders
169169
const responseHeaders = this.responseHeaders === 'raw'
170-
? (Array.isArray(rawHeaders) ? util.parseRawHeaders(rawHeaders) : [])
170+
? util.parseRawHeaders(rawHeaders)
171171
: headers
172172
this.onInfo({ statusCode, headers: responseHeaders })
173173
}
@@ -181,7 +181,7 @@ class PipelineHandler extends AsyncResource {
181181
this.handler = null
182182
const rawHeaders = controller?.rawHeaders
183183
const responseHeaders = this.responseHeaders === 'raw'
184-
? (Array.isArray(rawHeaders) ? util.parseRawHeaders(rawHeaders) : [])
184+
? util.parseRawHeaders(rawHeaders)
185185
: headers
186186
body = this.runInAsyncScope(handler, null, {
187187
statusCode,

‎deps/undici/src/lib/api/api-request.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ class RequestHandler extends AsyncResource {
2121
throw new InvalidArgumentError('invalid callback')
2222
}
2323

24-
if (highWaterMark && (typeof highWaterMark !== 'number' || highWaterMark < 0)) {
24+
if (highWaterMark != null && (!Number.isFinite(highWaterMark) || highWaterMark < 0)) {
2525
throw new InvalidArgumentError('invalid highWaterMark')
2626
}
2727

@@ -92,7 +92,7 @@ class RequestHandler extends AsyncResource {
9292

9393
const rawHeaders = controller?.rawHeaders
9494
const responseHeaderData = responseHeaders === 'raw'
95-
? (Array.isArray(rawHeaders) ? util.parseRawHeaders(rawHeaders) : [])
95+
? util.parseRawHeaders(rawHeaders)
9696
: headers
9797

9898
if (statusCode < 200) {

‎deps/undici/src/lib/api/api-stream.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ class StreamHandler extends AsyncResource {
8585

8686
const rawHeaders = controller?.rawHeaders
8787
const responseHeaderData = responseHeaders === 'raw'
88-
? (Array.isArray(rawHeaders) ? util.parseRawHeaders(rawHeaders) : [])
88+
? util.parseRawHeaders(rawHeaders)
8989
: headers
9090

9191
if (statusCode < 200) {

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL