Update dependency undici to v5.19.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
undici (source)	5.16.0 -> 5.19.1

GitHub Vulnerability Alerts

CVE-2023-23936

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@​timon8) for reporting this vulnerability.

CVE-2023-24807

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

• https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

---

Release Notes

nodejs/undici

v5.19.1

Compare Source

⚠️ Security Release ⚠️

• Regular Expression Denial of Service in Headers with CVE-2023-24807
• CRLF Injection in Nodejs ‘undici’ via host with CVE-2023-23936

This release is part of the Node.js security release train: https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

v5.19.0

Compare Source

What's Changed

• fix(fetch): raise AbortSignal max event listeners by @​KhafraDev in https://github.com/nodejs/undici/pull/1910
• fix: content-disposition header parsing by @​climba03003 in https://github.com/nodejs/undici/pull/1911
• fix: remove test by @​KhafraDev in https://github.com/nodejs/undici/pull/1916
• feat: add Headers.prototype.getSetCookie by @​KhafraDev in https://github.com/nodejs/undici/pull/1915
• fix(headers): clone getSetCookie list & add getSetCookie type by @​KhafraDev in https://github.com/nodejs/undici/pull/1917
• doc(mock): update out-of-date reply documentation by @​p9f in https://github.com/nodejs/undici/pull/1913
• fix(types): add missing keepAlive params by @​SkeLLLa in https://github.com/nodejs/undici/pull/1918
• Make the fetch() abort test pass locally, on Linux and Mac, Node 18/19. by @​mcollina in https://github.com/nodejs/undici/pull/1927

New Contributors

• @​climba03003 made their first contribution in https://github.com/nodejs/undici/pull/1911
• @​p9f made their first contribution in https://github.com/nodejs/undici/pull/1913

Full Changelog: nodejs/undici@v5.18.0...v5.19.0

v5.18.0

Compare Source

What's Changed

• Add ability to set TCP keepalive by @​xconverge in https://github.com/nodejs/undici/pull/1904
• use faster timers by @​ronag in https://github.com/nodejs/undici/pull/1908
• fix: ensure header value is a string by @​ronag in https://github.com/nodejs/undici/pull/1899

Full Changelog: nodejs/undici@v5.17.1...v5.18.0

v5.17.1

Compare Source

What's Changed

• fix: bad buffer slice (nodejs/undici@d2be675)

Full Changelog: nodejs/undici@v5.17.0...v5.17.1

v5.17.0

Compare Source

What's Changed

• fix(wpts): Blob is a global getter in >=v19.x.x by @​KhafraDev in https://github.com/nodejs/undici/pull/1880
• doc: fix anchor links dispatcher.stream by @​RafaelGSS in https://github.com/nodejs/undici/pull/1881
• wpt: make runner more resilient by @​KhafraDev in https://github.com/nodejs/undici/pull/1884
• Make test pass in v19.x by @​mcollina in https://github.com/nodejs/undici/pull/1879
• Correct the type of DispatchOptions["headers"] by @​pan93412 in https://github.com/nodejs/undici/pull/1896
• perf(content-type parser): faster string collector by @​KhafraDev in https://github.com/nodejs/undici/pull/1894
• feat: expose content-type parser by @​KhafraDev in https://github.com/nodejs/undici/pull/1895
• fix(types): Update DispatchOptions type for missing "blocking" by @​xconverge in https://github.com/nodejs/undici/pull/1889
• fix(types): update error type definitions by @​rafaelcr in https://github.com/nodejs/undici/pull/1888
• fix: ensure connection header is a string by @​ronag in https://github.com/nodejs/undici/pull/1900
• fix: throw if invalid content-type header by @​ronag in https://github.com/nodejs/undici/pull/1901
• fix(fetch): use semicolon for Cookie header delimiter by @​KhafraDev in https://github.com/nodejs/undici/pull/1906
• Use FastBuffer by @​ronag in https://github.com/nodejs/undici/pull/1907

New Contributors

• @​pan93412 made their first contribution in https://github.com/nodejs/undici/pull/1896
• @​rafaelcr made their first contribution in https://github.com/nodejs/undici/pull/1888

Full Changelog: nodejs/undici@v5.16.0...v5.17.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.