-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 30 Jul 2026 15:40:51 +0200 Source: node-undici Architecture: source Version: 8.9.0+dfsg+~cs3.2.0-1 Distribution: unstable Urgency: medium Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org> Changed-By: Jérémy Lal <kapouer@melix.org> Closes: 1143063 1143070 Changes: node-undici (8.9.0+dfsg+~cs3.2.0-1) unstable; urgency=medium . * New upstream version 8.9.0+dfsg+~cs3.2.0 Fixes the following vulnerabilities: + CVE-2026-13697 (High): cross-user information disclosure and parse-time crash via degenerate private cache directives. Closes: #1143070 + CVE-2026-14643 (Medium): optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. + CVE 2026-15157 (Medium): a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. + CVE-2026-16728 (Medium): the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. + CVE-2026-16729 (Medium): unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Closes: #1143063 Checksums-Sha1: 0bca683da7483e37dea6cfa140bd39d6fe22fd2b 2695 node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc 1e975bdeff806d9ffb1cb822539a2d74b6b5ac17 40048 node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz 3478d183cc28664be2a5f70dac38a36208d77373 745560 node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz d126f8976aa9b9e512031f2e6bd48f8d88e1c05d 216260 node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz f40915a24443bc61fa43c619e82bf5eee7194a2e 9527 node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo Checksums-Sha256: 8cfc21fdae13e026c0e2818cb659e4f9d6d7e378f6e1a1da0b2b7f1d178660a3 2695 node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc 38d43f2df5ac3dcf51cc5a9866973fe5951f90bd44d9fab8dbf0dc2ed0f025f3 40048 node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz 2eccdde43f106531b4c5ccd95ff1238c9a60faa87e6dbd5b1b7e78e87edbfaf6 745560 node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz 2e1973920cf5f21b4f7c48f29f303bfbf30e2a19e09275d1aff904302513297a 216260 node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz 39cd03b45dc97b84bcfacb896f872210571d6eab8682583155b1bd64ea36874f 9527 node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo Files: 49d5d7611855b8109fd998a6273f0a6a 2695 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc a03285069cc3d8477877fba2f1eabf2f 40048 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz fa09636c63908b197d015ca5c2fbfeba 745560 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz b9830cf1190791d53a278eda700783fc 216260 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz 996f92d088f2d378fe43c12e10a6e78e 9527 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCAAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmprVH0SHGthcG91ZXJA bWVsaXgub3JnAAoJEGYRwF7dOfN0KtsP/3Bd4bNyODQ/+nBrD2Bx762EhrsSfuS8 0VppIoW5mSaXVPZX7S5uC7kFpLnUvRqyUxhIjifzhJgrXYLtvfC2JmB1ih9v99bK SeBCyODlcaP8PtfRMG8RY8g8zg6L/T8x1/ya7+gvR6mdYMPqIWhmanPF0QTXt3j0 iu0x3bwPoGUU1tyTR6lNkadmAaqCwT6hyL8embTVVX3p3opskhqfukLz9mtbX02b AUKEqREXJjFIqdIK29lTCDlc803cDC7NDbjvgP3czP9EhwAPyHugY4kX8tHmO6LO slChhDBlkThrzXWclVHGuuZf8di8dmseH9IUEuK6am+FEFpd4ZmSjQACmEnpHxGK BU5OpVhgc2nLmvpxmniGrDuH/wrVcxJKXLpuVHSDggKSRjwG74u9kt4ViMKIh+Rr FfdOPSGWUySMABXCNsARp2qN+zeQS9dPSBkS8HsWJegPrWint4s+CjVSFQ5Ey8/W kBp+VuCpOuk+AdOIpVHCI891wrn/fNXHzy4OacuUp/X1IUyRTkLGmAfgKd2pJTaW QiuG7Y/kAN+7a07vuH0Ka5HGMh7yVP/+szHGvTrKIz+SUz2Ox6GtA4fFaPAPFlq5 pJINMK7Pi1qRd+kZj0qnmAwEuuqixsiWxYXeZ1y05vHXFnWebPKqY/8ukTh98IE1 VVAcTSgJU8Vy =9Nna -----END PGP SIGNATURE-----
