-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| undici | npm | < 5.8.0 | 5.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing validation in three key areas: headers, path, and method. The commit diff shows added regex validation (tokenRegExp, headerCharRegex, invalidPathRegex) to these components. The vulnerable functions are clearly the Request constructor (handling path/method validation) and processHeader function (handling header construction) before these regex checks were implemented. These functions directly processed user-controlled inputs without sanitizing CRLF sequences, allowing injection attacks. The added tests in client.js confirm these were the injection points.