Component

Other

Bug Description

Security vulnerability GHSA-g9mf-h72j-4rw9 (CVE-2026-22036) affects the undici npm package used transitively in this project.

The vulnerability allows unbounded decompression chains in HTTP responses, potentially causing high CPU usage and memory allocation.

Expected Behavior

npm audit should report no vulnerabilities for GHSA-g9mf-h72j-4rw9.

Steps to Reproduce

1. Run npm audit
2. Observe vulnerability reported for [email protected]

Dependency chain:

[email protected] → [email protected] → [email protected] (vulnerable)

Additional Context

Risk Assessment: Low - undici is only used transitively by markdown-link-check for CI/CD link validation.

Remediation: Add npm overrides to force undici to patched version 7.18.2.

References:

• GitHub Advisory
• OSV Database