Source: node-undici Version: 7.3.0+dfsg1+~cs24.12.11-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for node-undici. CVE-2025-23167[0]: | Improper HTTP header block termination in llhttp This is an issue from the latest node.js advisory affecting llhttp, can you double check how it affects node-undici's embedded copy? If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-23167 https://www.cve.org/CVERecord?id=CVE-2025-23167 [1] https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-termination-in-llhttp-cve-2025-23167---medium Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
