StarpTech / apollo-datasource-http

Optimized JSON HTTP Data Source for Apollo Server
MIT License
73 stars 32 forks source link

[Security] Upgrade Undici dependency to latest version #40

Open Dieman89 opened 2 years ago

Dieman89 commented 2 years ago

Detailed paths

Introduced through: › apollo-datasource-http@0.21.0 › undici@4.16.0 Fix: Upgrade to undici@5.5.1

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Certificate Validation due to Undici.ProxyAgent missing verification of the remote server's certificate, which leads to exposure of all the requests and responses data to the proxy.