$ the-wire · showcase
undici closes two redirect credential leaks
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
2 people shipped this
undici fixed two ways a redirect could hand one origin's credentials or cached response to another, alongside a gyp-next bump carried by node-gyp.
fix(redirect): strip credentials from array-of-tuples headers nodejs/undici
The redirect handler assumed every Array header was a flat [name, value, name, value, ...] list, so a plain array of tuples such as Object.entries(headers) defeated cross-origin credential stripping whenever a cache or deduplicate interceptor sat outside redirect().
fix(cache): prevent cross-origin redirect cache bypass nodejs/undici
A redirect bouncing through an untrusted intermediate origin onto the trusted one was cached under the original key because the origin guard only checked the final URL, and hops dropped no-cache, must-revalidate, zero freshness, Vary: * and Vary: Authorization, so a private or authenticated response could be served to unrelated callers. Every hop in the redirect now has to satisfy the policy.
docs: add security release notes nodejs/undici
Matteo Collina landed the security release notes documenting this round of redirect and cache fixes in undici.
feat: update gyp-next to v0.22.4 nodejs/node-gyp
node-gyp moved to gyp-next v0.22.4, an automated release bump with no behavior change described; native addon builds pick it up on the next publish.
feat: update gyp-next to v0.22.4 (#3383) nodejs/node-gyp
The same gyp-next v0.22.4 update landed on the node-gyp default branch, closing the automated release bump.
Action items
