[From nobody Thu Jul 30 15:25:05 2026 Received: (at 1143063-close) by bugs.debian.org; 30 Jul 2026 14:22:46 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 11; hammy, 150; neutral, 320; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:54910) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wpReo-00GvCD-0H for 1143063-close@bugs.debian.org; Thu, 30 Jul 2026 14:22:46 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wpRem-00Cte7-2V for 1143063-close@bugs.debian.org; Thu, 30 Jul 2026 14:22:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=oq1hexn7PfJz08xXTEF8Jt3ZD9077wT+ATKJX0f1BXc=; b=P71HgALDtCps9bpVODVZ/629cC wYcdJgOB3a0C6Ng5PoOXW88iytpTtVB9gGR9IEuttomAXWofSeKMr0GNh+ApgVFBABlUUopbI3Adf Up4DXIm9BSWWgNljIBfKuufs7yfYKNN3BDLa0yepkjPXpg7zoGhFDQTqxrw5NMDpakiZ0A93vhFPV g6TNx9X4d4zWKdbx8riKfy7qvNxO1XoCBGM+sVLVoSa52dj+cmPRSw1Xl/AqtgrucmSc7WcBoVSVJ CABkSbm5g1KFw6VD+r/PVhYXRAjIwhHUOd5yZGhqIJiuDxOTkmdcoLmreVJSkIWJxvNaDQWgd1bFy WenTJP9Q==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wpRel-00000006b7e-3Tzz; Thu, 30 Jul 2026 14:22:43 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: =?utf-8?b?SsOpcsOpbXkgTGFs?= <kapouer@melix.org> To: 1143063-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: node-undici Debian: DAK Debian-Changes: node-undici_8.9.0+dfsg+~cs3.2.0-1_source.changes Debian-Source: node-undici Debian-Version: 8.9.0+dfsg+~cs3.2.0-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1143063: fixed in node-undici 8.9.0+dfsg+~cs3.2.0-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============4387134203120749769==" Message-Id: <E1wpRel-00000006b7e-3Tzz@fasolo.debian.org> Date: Thu, 30 Jul 2026 14:22:43 +0000 X-CrossAssassin-Score: 2 --===============4387134203120749769== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: node-undici Source-Version: 8.9.0+dfsg+~cs3.2.0-1 Done: J=C3=A9r=C3=A9my Lal <kapouer@melix.org> We believe that the bug you reported is fixed in the latest version of node-undici, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1143063@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. J=C3=A9r=C3=A9my Lal <kapouer@melix.org> (supplier of updated node-undici pac= kage) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 30 Jul 2026 15:40:51 +0200 Source: node-undici Architecture: source Version: 8.9.0+dfsg+~cs3.2.0-1 Distribution: unstable Urgency: medium Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.= debian.org> Changed-By: J=C3=A9r=C3=A9my Lal <kapouer@melix.org> Closes: 1143063 1143070 Changes: node-undici (8.9.0+dfsg+~cs3.2.0-1) unstable; urgency=3Dmedium . * New upstream version 8.9.0+dfsg+~cs3.2.0 Fixes the following vulnerabilities: + CVE-2026-13697 (High): cross-user information disclosure and parse-time crash via degenerate private cache directives. Closes: #1143070 + CVE-2026-14643 (Medium): optional whitespace around =3D in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. + CVE 2026-15157 (Medium): a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. + CVE-2026-16728 (Medium): the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. + CVE-2026-16729 (Medium): unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Closes: #1143063 Checksums-Sha1: 0bca683da7483e37dea6cfa140bd39d6fe22fd2b 2695 node-undici_8.9.0+dfsg+~cs3.2.= 0-1.dsc 1e975bdeff806d9ffb1cb822539a2d74b6b5ac17 40048 node-undici_8.9.0+dfsg+~cs3.2= .0.orig-fastify-busboy.tar.xz 3478d183cc28664be2a5f70dac38a36208d77373 745560 node-undici_8.9.0+dfsg+~cs3.= 2.0.orig.tar.xz d126f8976aa9b9e512031f2e6bd48f8d88e1c05d 216260 node-undici_8.9.0+dfsg+~cs3.= 2.0-1.debian.tar.xz f40915a24443bc61fa43c619e82bf5eee7194a2e 9527 node-undici_8.9.0+dfsg+~cs3.2.= 0-1_source.buildinfo Checksums-Sha256: 8cfc21fdae13e026c0e2818cb659e4f9d6d7e378f6e1a1da0b2b7f1d178660a3 2695 node-u= ndici_8.9.0+dfsg+~cs3.2.0-1.dsc 38d43f2df5ac3dcf51cc5a9866973fe5951f90bd44d9fab8dbf0dc2ed0f025f3 40048 node-= undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz 2eccdde43f106531b4c5ccd95ff1238c9a60faa87e6dbd5b1b7e78e87edbfaf6 745560 node= -undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz 2e1973920cf5f21b4f7c48f29f303bfbf30e2a19e09275d1aff904302513297a 216260 node= -undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz 39cd03b45dc97b84bcfacb896f872210571d6eab8682583155b1bd64ea36874f 9527 node-u= ndici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo Files: 49d5d7611855b8109fd998a6273f0a6a 2695 javascript optional node-undici_8.9.0+= dfsg+~cs3.2.0-1.dsc a03285069cc3d8477877fba2f1eabf2f 40048 javascript optional node-undici_8.9.0= +dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz fa09636c63908b197d015ca5c2fbfeba 745560 javascript optional node-undici_8.9.= 0+dfsg+~cs3.2.0.orig.tar.xz b9830cf1190791d53a278eda700783fc 216260 javascript optional node-undici_8.9.= 0+dfsg+~cs3.2.0-1.debian.tar.xz 996f92d088f2d378fe43c12e10a6e78e 9527 javascript optional node-undici_8.9.0+= dfsg+~cs3.2.0-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCAAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmprVH0SHGthcG91ZXJA bWVsaXgub3JnAAoJEGYRwF7dOfN0KtsP/3Bd4bNyODQ/+nBrD2Bx762EhrsSfuS8 0VppIoW5mSaXVPZX7S5uC7kFpLnUvRqyUxhIjifzhJgrXYLtvfC2JmB1ih9v99bK SeBCyODlcaP8PtfRMG8RY8g8zg6L/T8x1/ya7+gvR6mdYMPqIWhmanPF0QTXt3j0 iu0x3bwPoGUU1tyTR6lNkadmAaqCwT6hyL8embTVVX3p3opskhqfukLz9mtbX02b AUKEqREXJjFIqdIK29lTCDlc803cDC7NDbjvgP3czP9EhwAPyHugY4kX8tHmO6LO slChhDBlkThrzXWclVHGuuZf8di8dmseH9IUEuK6am+FEFpd4ZmSjQACmEnpHxGK BU5OpVhgc2nLmvpxmniGrDuH/wrVcxJKXLpuVHSDggKSRjwG74u9kt4ViMKIh+Rr FfdOPSGWUySMABXCNsARp2qN+zeQS9dPSBkS8HsWJegPrWint4s+CjVSFQ5Ey8/W kBp+VuCpOuk+AdOIpVHCI891wrn/fNXHzy4OacuUp/X1IUyRTkLGmAfgKd2pJTaW QiuG7Y/kAN+7a07vuH0Ka5HGMh7yVP/+szHGvTrKIz+SUz2Ox6GtA4fFaPAPFlq5 pJINMK7Pi1qRd+kZj0qnmAwEuuqixsiWxYXeZ1y05vHXFnWebPKqY/8ukTh98IE1 VVAcTSgJU8Vy =3D9Nna -----END PGP SIGNATURE----- --===============4387134203120749769== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCamteMwAKCRCb9qggYcy5 IWw2AP0fUnnO/Urzx+FMVdYT5tTaRaGoX5/+ssQDnvfinunaagEA5NjyYq8gmUhn sAUc0BK2DDNda3YoH8pYOn8yaI2diwQ= =UpSb -----END PGP SIGNATURE----- --===============4387134203120749769==-- ]