Fix GHSA-vrm6-8vpv-qv8q: override undici to ^6.24.0#765
Conversation
Add npm overrides to force undici to ^6.24.0, fixing the WebSocket permessage-deflate decompression bomb vulnerability (CVE-2026-1526). This updates undici from 5.29.0 to 6.24.1 across all transitive dependencies (@actions/core and @actions/github). Agent-Logs-Url: https://github.com/github/webpack-bundlesize-compare-action/sessions/83dc3a69-3a72-415b-837e-dafd4cb7c840 Co-authored-by: arelia <2359538+arelia@users.noreply.github.com>
Bundle Stats — With chunk and module informationHey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
Changeset
View detailed bundle breakdownAdded No assets were added Removed No assets were removed Bigger No assets were bigger Smaller No assets were smaller Unchanged
|
Bundle StatsHey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded No assets were added Removed
Bigger
Smaller
Unchanged No assets were unchanged |
Bundle Stats — Flipped aroundHey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded
Removed No assets were removed Bigger
Smaller
Unchanged No assets were unchanged |
Bundle Stats — Non existentHey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded No assets were added Removed No assets were removed Bigger No assets were bigger Smaller No assets were smaller Unchanged No assets were unchanged |
Bundle Stats — No changesHey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded No assets were added Removed No assets were removed Bigger No assets were bigger Smaller No assets were smaller Unchanged
|
Bundle Stats — With describe-assets: 'none'Hey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdown |
Bundle Stats — With describe-assets: 'changed-only'Hey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded No assets were added Removed No assets were removed Bigger No assets were bigger Smaller No assets were smaller |
There was a problem hiding this comment.
Pull request overview
This PR addresses the GHSA-vrm6-8vpv-qv8q security advisory by ensuring the repository no longer installs vulnerable undici@5.29.0, without requiring an upgrade to ESM-only @actions/github@9+ (keeping the project’s CommonJS toolchain intact).
Changes:
- Added an npm
overridesrule to forceundicito^6.24.0across transitive dependents. - Regenerated
package-lock.jsonto resolve toundici@6.24.1and update the dependency tree accordingly. - Updated the generated third-party license bundle to reflect the new dependency graph.
Show a summary per file
| File | Description |
|---|---|
| package.json | Adds npm overrides to force patched undici across transitive dependencies. |
| package-lock.json | Refreshes the lockfile to install undici@6.24.1 and remove vulnerable/unused transitive entries. |
| dist/licenses.txt | Updates the bundled license attributions to match the new resolved dependencies. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/5 changed files
- Comments generated: 0
Transitive dependency
undici@5.29.0(via@actions/coreand@actions/github) is vulnerable to unbounded memory consumption in WebSocket permessage-deflate decompression.Changes
overridesto pinundicito^6.24.0across all transitive consumersWhy overrides instead of bumping direct dependencies
@actions/github@9.0.0is the first version shippingundici@^6.23.0, but it's ESM-only ("type": "module"), incompatible with this project's CommonJS toolchain (tscmodule: "commonjs", Jest CJS). Overrides update the transitive dep without a full ESM migration.Reachability
Not reachable (high confidence). The vulnerability is in
PerMessageDeflate.decompress()— the WebSocket client path. This codebase only uses undici indirectly via@actions/http-clientfor HTTPfetch/ProxyAgent. No WebSocket connections are established. Update satisfies scanners rather than mitigating active risk.Original prompt
This section details the Dependabot vulnerability alert you should resolve
<alert_title>Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression</alert_title>
<alert_description>## Description
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.
The vulnerability exists in the
PerMessageDeflate.decompress()method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.Impact
Patches
Users should upgrade to fixed versions.
Workarounds
No workaround are possible.</alert_description>
high
https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q https://nvd.nist.gov/vuln/detail/CVE-2026-1526 https://hackerone.com/reports/3481206 https://cna.openjsf.org/security-advisories.html https://datatracker.ietf.org/doc/html/rfc7692 https://owasp.org/www-community/attacks/Denial_of_Service https://github.com/advisories/GHSA-vrm6-8vpv-qv8qGHSA-vrm6-8vpv-qv8q, CVE-2026-1526
undici
npm
<vulnerable_versions>5.29.0</vulnerable_versions>
<patched_version>6.24.0</patched_version>
<manifest_path>package-lock.json</manifest_path>
<agent_instructions>please open a PR to update the following dependencies in order to update undici
@actions/core 2.0.0
@actions/github 6.0.1
we want to transitively import undici 6.24.0 or higher</agent_instructions>
<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indirect and hard to trace). If no patched version is available, check the alert_description field for a Workarounds section — the advisory may describe configuration changes or usage patterns that mitigate the vulnerability without a version update. If a workaround is available, apply it and leave a code comment referencing the advisory identifier explaining it is a temporary mitigation. If neither a patch nor a workaround is available, explain in the PR description why the alert cannot be resolved automatically so a human reviewer can take over. Inspect the repository to determine which package manager is used (e.g. lock files, config files, build scripts) and use that tooling to perform the update — do not edit lock files directly. If the version constraint in the manifest (e.g. package.json, Gemfile, pyproject.toml) caps the version below the fix, update the constraint first. For transitive dependencies, determine whether it is simpler to update the direct dependency that pulls in the vulnerable package or to update the transitive dependency directly, and choose the least disruptive approach. If upgrading to fix the vulnerability forces a major version bump or known breaking changes, review the changelog or release notes, then audit t...