undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Impact Undici's cache interceptor mishandles optional whitespace OWS placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" OWS before = or no-cache= "authorization" OWS after =. The parser either drops the directive entirely or stores a...

EUVD-2026-50567

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives...

GHSA-JR45-8VMC-QM54 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Impact Undici's cache interceptor mishandles optional whitespace OWS placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" OWS before = or no-cache= "authorization" OWS after =. The parser either drops the directive entirely or stores a...

NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.0...

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then serve...

EUVD-2026-50409

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives...

GHSA-4CWX-7WF7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then serve...

NPM: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

NPM: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.0...

Updated squid packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Due to a Improper Validation of Syntactic Correctness of Inputbug, Squid is vulnerable to a Out-of-bounds Read attack against the FTP gateway. CVE-2026-47729 Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer...

MGASA-2026-0319 Updated squid packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Due to a Improper Validation of Syntactic Correctness of Inputbug, Squid is vulnerable to a Out-of-bounds Read attack against the FTP gateway. CVE-2026-47729 Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer...

CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

UBUNTU-CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-68945

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-ke...

Security update for bind

This update for bind fixes the following issues CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. CVE-2026-11331: potential wildcard CNAME RPZ policy bypass bsc1271984. CVE-2026-11622: potential memory usage beyond configured limits bsc1271986. CVE-2026-11721: cache poisoning...

SUSE-SU-2026:3477-1 Security update for bind

This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass bsc1271984. - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721: Cache...

Security update for bind

This update for bind fixes the following issues CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. CVE-2026-11331: potential wildcard CNAME RPZ policy bypass bsc1271984. CVE-2026-11622: potential memory usage beyond configured limits bsc1271986. CVE-2026-11721: cache poisoning...

SUSE-SU-2026:3476-1 Security update for bind

This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass bsc1271984. - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721: Cache...

CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

EUVD-2026-52343

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-68945

CVE-2026-68945 affects Angular’s HttpTransferCache in HttpClient. Before 20.3.27, 21.2.19, and 22.0.2, comma-joining repeated request parameters caused semantically distinct requests to share a transfer-cache key, leading to reuse of a wrong backend response and potential state poisoning. The iss...