https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 19:19:27 +0000 https://db.gcve.eu/vuln/ghsa-v9p9-hfj2-hcw8 <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range `server_max_window_bits` value (outside zlib&#39;s valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.</p> <p>The vulnerability exists because:</p> <p>1. The `isValidClientWindowBits()` function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 2. The `createInflateRaw()` call is not wrapped in a try-catch block 3. The resulting exception propagates up through the call stack and crashes the Node.js process</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range `server_max_window_bits` value (outside zlib&#39;s valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.</p> <p>The vulnerability exists because:</p> <p>1. The `isValidClientWindowBits()` function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 2. The `createInflateRaw()` call is not wrapped in a try-catch block 3. The resulting exception propagates up through the call stack and crashes the Node.js process</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> https://db.gcve.eu/vuln/ghsa-v9p9-hfj2-hcw8