refactoring #55
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,10 +24,10 @@ | |
| ], | ||
| "devDependencies": { | ||
| "@runtime-edge/format": "workspace:*", | ||
| "esbuild": "0.24.0", | ||
| "event-target-shim": "6.0.2", | ||
| "tsup": "8", | ||
| "undici": "6.21.0", | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- package metadata ---'
cat -n packages/primitives/package.json
printf '%s\n' '--- undici references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' 'undici|from ["'\'']undici|require\(["'\'']undici' .
printf '%s\n' '--- relevant package/build files ---'
git ls-files | rg '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|package\.json|tsconfig[^/]*\.json|rollup[^/]*|vite[^/]*|webpack[^/]*|esbuild[^/]*|turbo[^/]*|nx[^/]*)$' | head -200Repository: khulnasoft/runtime-edge Length of output: 4729 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- build script ---'
cat -n packages/primitives/scripts/build.ts
printf '%s\n' '--- fetch implementation ---'
cat -n packages/primitives/src/primitives/fetch.js
printf '%s\n' '--- published load package ---'
cat -n packages/primitives/load/package.json
printf '%s\n' '--- primitives source files ---'
git ls-files packages/primitives | sort
printf '%s\n' '--- package-level workspace and publish configuration ---'
cat -n package.jsonRepository: khulnasoft/runtime-edge Length of output: 12006 🌐 Web query:
💡 Result: GHSA-35p6-xmwp-9g52 (CVE-2026-6733) is a security vulnerability in the undici HTTP/1.1 client that allows for response queue poisoning when reusing keep-alive sockets [1][2]. Vulnerability Mechanism The issue occurs when an attacker-controlled or compromised upstream HTTP/1.1 server injects an unsolicited response onto an idle socket after a request has already completed [3][4]. Because undici uses keep-alive connections, the client may subsequently dispatch a new request on that same socket. The client incorrectly associates the injected, unsolicited response with the new, legitimate request, leading to the delivery of incorrect data [2][5]. Patched Versions To mitigate this vulnerability, users should upgrade to the following versions or later [3][2]: - v6.27.0 - v7.28.0 - v8.5.0 Workaround If an immediate upgrade is not possible, the vulnerability can be mitigated by disabling keep-alive connection reuse. This can be achieved by setting keepAliveTimeout: 0 on the undici Client or Pool [4][5]. Note: While some references initially mentioned v6.26.0 [1][6], the official security advisory and GitHub release data specify v6.27.0 as the correct patched version for the 6.x release line [3][7]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- compatibility patch ---'
cat -n packages/primitives/src/patches/undici-core-request.js
printf '%s\n' '--- lockfile undici entries ---'
sed -n '210,245p' pnpm-lock.yaml
sed -n '10605,10635p' pnpm-lock.yaml
printf '%s\n' '--- generated-artifact and package ignore rules ---'
cat -n packages/primitives/.gitignore
printf '%s\n' '--- build output references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' 'packages/primitives/(dist|load)|dist/load|dist/fetch|undici' .gitignore packages/primitives README.md packages/primitives/README.md package.json turbo.json 2>/dev/null || trueRepository: khulnasoft/runtime-edge Length of output: 17839 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import json
import re
root = Path("packages/primitives")
pkg = json.loads((root / "package.json").read_text())
build = (root / "scripts/build.ts").read_text()
fetch = (root / "src/primitives/fetch.js").read_text()
load_pkg = json.loads((root / "load/package.json").read_text())
assert pkg["devDependencies"]["undici"] == "6.21.0"
assert '"files"' in (root / "package.json").read_text()
assert "dist" in pkg["files"]
assert re.search(r"\bbundle:\s*true", build)
assert not re.search(r'external\s*:\s*[^,\n]*undici', build)
assert re.search(r'import\s+undici\s+from\s+[\'"]undici[\'"]', fetch)
assert "undici.fetch(" in fetch
assert load_pkg["main"] == "../dist/load.js"
print("undici_version:", pkg["devDependencies"]["undici"])
print("published_files:", pkg["files"])
print("bundle_enabled:", True)
print("undici_externalized:", False)
print("runtime_fetch_import:", True)
print("runtime_fetch_call:", True)
print("published_load_entry:", load_pkg["main"])
print("conclusion: undici is bundled into the published runtime artifact")
PYRepository: khulnasoft/runtime-edge Length of output: 431 Upgrade the bundled The build bundles 🤖 Prompt for AI AgentsSource: MCP tools |
||
| "urlpattern-polyfill": "10.0.0" | ||
| }, | ||
| "engines": { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: khulnasoft/runtime-edge
Length of output: 5381
🌐 Web query:
Multer 1.4.5-lts.1 security advisories GHSA-72gw-mp4g-v24j affected versions fixed versions💡 Result:
The security advisory GHSA-72gw-mp4g-v24j (also tracked as CVE-2026-5079) identifies a Denial of Service (DoS) vulnerability in the multer package caused by deeply nested field names in multipart form data [1][2][3]. Affected Versions: - Versions 1.0.0 through 2.1.1 are affected [1][4][3]. - Version 3.0.0-alpha.1 is affected [1][2][3]. - Specifically, the version 1.4.5-lts.1 is included within the affected range (>= 1.0.0, < 2.2.0) [5][6]. Fixed Versions: - For the 2.x line, upgrade to 2.2.0 [5][1][2]. - For the 3.x prerelease line, upgrade to 3.0.0-alpha.2 [5][2][3]. Recommended Mitigation: In addition to upgrading to the patched versions, users are advised to configure the new limits.fieldNestingDepth option to the minimum depth required by their application to mitigate potential abuse [5][2]. As a partial workaround, users can set limits.fields to a reasonable value to reduce the number of fields permitted per request [1][4][2].
Citations:
🏁 Script executed:
Repository: khulnasoft/runtime-edge
Length of output: 26322
🌐 Web query:
site:github.com/expressjs/multer/security/advisories multer 1.4.5-lts.1 denial of service advisories💡 Result:
The version multer 1.4.5-lts.1 is affected by multiple Denial of Service (DoS) vulnerabilities, as it falls within the range of affected versions for several security advisories. Users are strongly advised to upgrade to the latest versions (typically 2.2.0 or higher) to mitigate these risks. Key vulnerabilities affecting version 1.4.5-lts.1 include: - Deeply Nested Field Names (CVE-2026-5079): Versions < 2.2.0 are vulnerable to DoS via deeply nested field names in multipart form data, which can consume excessive CPU and memory [1]. - Uncontrolled Recursion (CVE-2026-3520): Versions < 2.1.1 are vulnerable to DoS caused by malformed requests triggering uncontrolled recursion [2]. - Unhandled Exception from Malformed Requests (CVE-2025-7338): Versions >= 1.4.4-lts.1 and < 2.0.2 allow attackers to trigger a process crash via malformed requests [3]. - Unhandled Exception via Empty String Field Names (CVE-2025-48997): Versions >= 1.4.4-lts.1 and < 2.0.1 are vulnerable to process crashes when an upload request contains an empty string field name [4]. - Maliciously Crafted Requests (CVE-2025-47944): Versions >= 1.4.4-lts.1 and < 2.0.0 allow a process crash via malformed multi-part upload requests [5]. - Memory Leaks from Unclosed Streams (CVE-2025-47935): Versions < 2.0.0 are subject to resource exhaustion due to improper stream handling when request streams emit errors [6]. To address these vulnerabilities, it is recommended to upgrade to version 2.2.0 or later [1]. For the issue related to deeply nested field names, you should also configure the limits.fieldNestingDepth option to a depth appropriate for your application requirements [1].
Citations:
🌐 Web query:
npm test-listen 1.1.0 source host 127.0.0.1 server.listen💡 Result:
The
test-listennpm package (version 1.1.0) is a utility designed to help test HTTP servers by providing a convenient way to get an ephemeral port and a corresponding URL [1][2]. Regarding your query about127.0.0.1andserver.listen: 1. Functionality: When you pass ahttp.Serverobject totest-listen, it handles the server's.listen()method internally [1][3]. It returns a Promise that resolves to a URL string in the formathttp://localhost:{port}[1][3]. 2. Hostname Customization: The package accepts a second optional parameter, which allows you to specify a custom hostname to be used in the returned URL instead of the defaultlocalhost[1][3]. For example, if you need to use127.0.0.1specifically to avoid potential DNS resolution issues or IPv6 conflicts (which can occur in certain environments like CI/CD runners), you can pass that as the second argument [3][4][5]. 3. Status: Note that thetest-listenpackage is officially deprecated by its maintainers, who recommend usingasync-listeninstead [3]. If you are encountering issues where a server binds to127.0.0.1but tests attempt to connect vialocalhost(or vice-versa), explicitly specifying the IP address as the hostname parameter intest-listenis a common workaround [3][5]. Additionally, ensure that your server is explicitly told to listen on the desired interface (e.g.,server.listen(0, '127.0.0.1')) if you need to restrict or define the bind address [4][5].Citations:
🏁 Script executed:
Repository: khulnasoft/runtime-edge
Length of output: 4444
🏁 Script executed:
Repository: khulnasoft/runtime-edge
Length of output: 4354
🌐 Web query:
Multer GHSA-72gw-mp4g-v24j severity CVSS 2.2.0 fieldNestingDepth💡 Result:
The vulnerability GHSA-72gw-mp4g-v24j (also identified as CVE-2026-5079) relates to a Denial of Service (DoS) flaw in the Multer middleware [1][2]. It has a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [3][4]. The vulnerability exists because Multer's dependency,
append-field, parses bracketed field names (e.g.,a[b][c]) without any restriction on nesting depth [1][5]. An attacker can exploit this by sending a crafted multipart request with deeply nested field names, forcing the application to allocate large, complex object structures that consume excessive CPU and memory [1][3]. To address this, maintainers introduced thelimits.fieldNestingDepthconfiguration option in Multer version 2.2.0 (and 3.0.0-alpha.2) [2][5]. Users should upgrade to these versions and setfieldNestingDepthto the minimum nesting level required by their application [1][2][6]. The default value for this limit is Infinity [6]. As a workaround or additional defense, developers are also advised to set a reasonable limit for thelimits.fieldsoption to restrict the total number of non-file fields per request [1][3].Citations:
🏁 Script executed:
Repository: khulnasoft/runtime-edge
Length of output: 506
🌐 Web query:
site:github.com/zeit/test-listen/blob test-listen index.js server.listen💡 Result:
The repository is now under
vercel/test-listen(formerlyzeit/test-listen). Itsindex.jscontains:[Source: GitHub
index.js][1][1] (github.com)
Citations:
Upgrade Multer and limit multipart nesting depth.
test-listenbinds the test server to the wildcard address, so external clients can reach the multipart listener. Upgrade tomulter@2.2.0or later and setlimits.fieldNestingDepthto the minimum required value. Its default isInfinity.🤖 Prompt for AI Agents
Source: MCP tools