Rampage0010

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x **Description** The cache interceptor mishandles optional whitespace around the equals sign in qualified `no-cache` or `private` `Cache-Control` directives. The parser may drop the directive or store a field name containing literal quote characters, causing the cache decision to ignore the qualification and store the response. In shared-cache mode, this can lead to a response containing one user's authenticated data being served to a subsequent caller, including unauthenticated users, if both requests share the same cache key. This issue affects applications that enable the cache interceptor in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified directives containing whitespace around the equals sign. **Recommendations** Update to version 7.29.0. Update to version 8.9.0.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions 2.3.1 through 4.1.0 **Description** The software fails to treat a literal backslash character (U+005C) as an authority delimiter. Because Node's native WHATWG URL parser normalizes backslashes to forward slashes for specific schemes such as http, https, ws, wss, ftp, and file, the two parsers may extract different hosts from the same input string. This discrepancy can be exploited in applications that use fast-uri to enforce host-based policies—such as allowlists, denylists, loopback or SSRF (Server-Side Request Forgery) filtering, redirect validation, or outbound proxy routing—before passing the URL to Node's URL or fetch consumers. This can lead to requests being steered to unintended destinations, including internal hosts, loopback addresses, or cloud metadata endpoints. **Recommendations** Upgrade fast-uri versions 4.x to 4.1.1 Upgrade fast-uri versions 3.x to 3.1.4 Upgrade fast-uri versions 2.x to 2.4.3