VDB

GHSA-2mjp-6q6p-2qxm

GHSA-2mjp-6q6p-2qxm PUBLISHED CVSS 6.5 MEDIUM

Undici has an HTTP Request/Response Smuggling issue

Record from GitHub Advisory Database · Published March 13, 2026

undici is fixed in 7.24.0 and 6.24.0 (npm)

Undici has an HTTP Request/Response Smuggling issue

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
undicinpm7.24.0, 6.24.0
langfuse-3Chainguard3.179.1-r1
librechatChainguard0.8.4-r3
langfuse-3Wolfi3.179.1-r1
pelias-apiChainguard7.6.0-r4
kibana-8.17Chainguard8.17.10-r13
jitsucom-jitsuWolfi2.11.0-r17
kibana-9.3Chainguard9.3.2-r0
kibana-8.19Chainguard8.19.13-r4
renovateChainguard43.84.0-r1
kibana-9.1Chainguard9.1.10-r7
renovateWolfi43.84.0-r1

8 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

VendorProductVersions
chainguardlangfuse-30
chainguardlibrechat0
wolfilangfuse-30
chainguardpelias-api0
chainguardkibana-8.170
wolfijitsucom-jitsu0
chainguardkibana-9.30
chainguardkibana-8.190
chainguardrenovate0
npmundici0, 7.0.0
chainguardkibana-9.10
wolfirenovate0
chainguardjitsucom-jitsu0
chainguardlangfuse-fips-30
chainguardcode-server0
chainguardkibana-8.180
chainguardgemini-cli0
chainguardkibana-9.00
chainguardkibana-9.20
wolficode-server0

Timeline

  • Mar 13, 2026 CVE Published
  • Mar 24, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-2mjp-6q6p-2qxm
vulnetix vdb fixes GHSA-2mjp-6q6p-2qxm

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-2mjp-6q6p-2qxm/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›