Skip to content

High severity CVEs in version of openapi-typescript used by project #79

@clewisln

Description

@clewisln

Several high severity CVEs have been created against the version of undici used by the openapi-typescript module.

If possible, please upgrade the version of the openapi module.

undici <=6.23.0
Severity: high
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - GHSA-g9mf-h72j-4rw9
Undici has an HTTP Request/Response Smuggling issue - GHSA-2mjp-6q6p-2qxm
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression - GHSA-vrm6-8vpv-qv8q
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation - GHSA-v9p9-hfj2-hcw8
Undici has CRLF Injection in undici via upgrade option - GHSA-4992-7rv2-5pvq
node_modules/undici
openapi-typescript 5.1.1 - 6.7.6
Depends on vulnerable versions of undici
node_modules/openapi-typescript
@openapi-contrib/openapi-schema-to-json-schema >=4.0.1
Depends on vulnerable versions of openapi-typescript
node_modules/@openapi-contrib/openapi-schema-to-json-schema

Note: this module is used by loopback

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions