Came across something in bun.lock around line 881 that looked worth flagging.
undici's cache interceptor mishandles malformed Cache‑Control private directives. An empty or degenerate private value can cause private response bodies, headers (including Set‑Cookie), and cached data to be stored in the shared cache and later served to other users, leading to unauthorized data disclosure. Additionally, combining an unqualified private directive with a qualified one triggers an uncaught TypeError that can crash the process (DoS). Both issues expose private information and can cause application downtime in shared cache mode. Upgrading to undici ≥8.9.0 (or ≥7.29.0) resolves the parsing bugs.
Something like this might fix it:
Upgrade undici to version 8.9.0 or later (e.g., run `npm install undici@8.9.0` or `bun add undici@8.9.0`).
For reference: rule CVE-2026-13697. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
bun.lockaround line 881 that looked worth flagging.undici's cache interceptor mishandles malformed Cache‑Control private directives. An empty or degenerate private value can cause private response bodies, headers (including Set‑Cookie), and cached data to be stored in the shared cache and later served to other users, leading to unauthorized data disclosure. Additionally, combining an unqualified private directive with a qualified one triggers an uncaught TypeError that can crash the process (DoS). Both issues expose private information and can cause application downtime in shared cache mode. Upgrading to undici ≥8.9.0 (or ≥7.29.0) resolves the parsing bugs.
Something like this might fix it:
For reference: rule
CVE-2026-13697. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.