Five undici DoS and TLS bypass advisories land at once

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent nodejs/undici

TLS options passed to Agent get dropped, so certificate validation can be bypassed outright; any client relying on per-Agent TLS configuration for validation is exposed. Treat this as the highest-priority of the batch.

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects nodejs/undici

Cross-origin redirects can poison the cache and disclose one user's response to another. If you follow redirects across origins through undici's cache, that is the exposure surface.

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser nodejs/undici

The EventSource parser holds memory without bound, so a hostile or malformed event stream is enough to take a process down. A second DoS path sits alongside it in the excessive content-encodings handling, which raises an unhandled error.

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens nodejs/undici

Subresource Integrity checks accept non-lowercase algorithm tokens, which lets an integrity check be bypassed for resources you believed were pinned by hash.

vfs: unflag nodejs/node

by mcollina

Matteo Collina's vfs unflagging moves the virtual filesystem work forward in node core.

tools: update OpenSSL on the selected branch nodejs/node

by panva

panva reworked the OpenSSL update tooling to use the selected workflow branch as the PR base and prefix titles for non-default branches, so pre-27 release lines can be updated against their own OpenSSL series via workflow_dispatch. It is groundwork for OpenSSL 4.1.

stream: do not miss 'drain' in fromWritable() nodejs/node

by James M Snell

When a write filled the classic Writable, fromWritable() recorded a pending drain but only subscribed to 'drain' after a later write was queued; if the event arrived first, for example from a microtask write callback, the flag stuck, canWrite stayed false, and the next write() or writev() never settled.