[Pkg-javascript-devel] node-undici_8.9.0+dfsg+~cs3.2.0-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 30 Jul 2026 15:40:51 +0200
Source: node-undici
Architecture: source
Version: 8.9.0+dfsg+~cs3.2.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel at lists.alioth.debian.org>
Changed-By: Jérémy Lal <kapouer at melix.org>
Closes: 1143063 1143070
Changes:
 node-undici (8.9.0+dfsg+~cs3.2.0-1) unstable; urgency=medium
 .
   * New upstream version 8.9.0+dfsg+~cs3.2.0
     Fixes the following vulnerabilities:
     + CVE-2026-13697 (High): cross-user information disclosure and
       parse-time crash via degenerate private cache directives.
       Closes: #1143070
     + CVE-2026-14643 (Medium): optional whitespace around = in qualified
       no-cache and private directives could bypass shared-cache
       restrictions and disclose authenticated data across users.
     + CVE 2026-15157 (Medium): a malicious type property on a duck-typed
       blob-like HTTP/1.1 request body could inject CRLF sequences into the
       generated content-type header.
     + CVE-2026-16728 (Medium): the retry interceptor could expose a stale
       Content-Length after resuming a partial response, potentially causing
       downstream response desynchronization, hangs, or corruption.
     + CVE-2026-16729 (Medium): unsanitized domain and unparsed values passed
       to setCookie() could inject cookie attributes.
       Closes: #1143063
Checksums-Sha1:
 0bca683da7483e37dea6cfa140bd39d6fe22fd2b 2695 node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc
 1e975bdeff806d9ffb1cb822539a2d74b6b5ac17 40048 node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz
 3478d183cc28664be2a5f70dac38a36208d77373 745560 node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz
 d126f8976aa9b9e512031f2e6bd48f8d88e1c05d 216260 node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz
 f40915a24443bc61fa43c619e82bf5eee7194a2e 9527 node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo
Checksums-Sha256:
 8cfc21fdae13e026c0e2818cb659e4f9d6d7e378f6e1a1da0b2b7f1d178660a3 2695 node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc
 38d43f2df5ac3dcf51cc5a9866973fe5951f90bd44d9fab8dbf0dc2ed0f025f3 40048 node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz
 2eccdde43f106531b4c5ccd95ff1238c9a60faa87e6dbd5b1b7e78e87edbfaf6 745560 node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz
 2e1973920cf5f21b4f7c48f29f303bfbf30e2a19e09275d1aff904302513297a 216260 node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz
 39cd03b45dc97b84bcfacb896f872210571d6eab8682583155b1bd64ea36874f 9527 node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo
Files:
 49d5d7611855b8109fd998a6273f0a6a 2695 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1.dsc
 a03285069cc3d8477877fba2f1eabf2f 40048 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0.orig-fastify-busboy.tar.xz
 fa09636c63908b197d015ca5c2fbfeba 745560 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0.orig.tar.xz
 b9830cf1190791d53a278eda700783fc 216260 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1.debian.tar.xz
 996f92d088f2d378fe43c12e10a6e78e 9527 javascript optional node-undici_8.9.0+dfsg+~cs3.2.0-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJGBAEBCAAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmprVH0SHGthcG91ZXJA
bWVsaXgub3JnAAoJEGYRwF7dOfN0KtsP/3Bd4bNyODQ/+nBrD2Bx762EhrsSfuS8
0VppIoW5mSaXVPZX7S5uC7kFpLnUvRqyUxhIjifzhJgrXYLtvfC2JmB1ih9v99bK
SeBCyODlcaP8PtfRMG8RY8g8zg6L/T8x1/ya7+gvR6mdYMPqIWhmanPF0QTXt3j0
iu0x3bwPoGUU1tyTR6lNkadmAaqCwT6hyL8embTVVX3p3opskhqfukLz9mtbX02b
AUKEqREXJjFIqdIK29lTCDlc803cDC7NDbjvgP3czP9EhwAPyHugY4kX8tHmO6LO
slChhDBlkThrzXWclVHGuuZf8di8dmseH9IUEuK6am+FEFpd4ZmSjQACmEnpHxGK
BU5OpVhgc2nLmvpxmniGrDuH/wrVcxJKXLpuVHSDggKSRjwG74u9kt4ViMKIh+Rr
FfdOPSGWUySMABXCNsARp2qN+zeQS9dPSBkS8HsWJegPrWint4s+CjVSFQ5Ey8/W
kBp+VuCpOuk+AdOIpVHCI891wrn/fNXHzy4OacuUp/X1IUyRTkLGmAfgKd2pJTaW
QiuG7Y/kAN+7a07vuH0Ka5HGMh7yVP/+szHGvTrKIz+SUz2Ox6GtA4fFaPAPFlq5
pJINMK7Pi1qRd+kZj0qnmAwEuuqixsiWxYXeZ1y05vHXFnWebPKqY/8ukTh98IE1
VVAcTSgJU8Vy
=9Nna
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20260730/3a6717fd/attachment.sig>