Spotted what might be an issue in config/lib/bun.lock around line 309.
The undici version 8.5.0 contains CVE‑2026–9697: the cache interceptor incorrectly processes malformed Cache‑Control private directives. An empty qualified private value can cause private responses (including Set‑Cookie headers) to be cached and leaked, and a mixed qualified/unqualified private directive can trigger an uncaught TypeError, potentially crashing the process. This affects shared cache usage, which is the default configuration, making the vulnerability high‑risk.
Something like this might fix it:
Upgrade undici to version 8.9.0 (or newer) in config/lib/bun.lock to resolve the vulnerability.
For reference: rule CVE-2026-13697. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
config/lib/bun.lockaround line 309.The undici version 8.5.0 contains CVE‑2026–9697: the cache interceptor incorrectly processes malformed Cache‑Control private directives. An empty qualified private value can cause private responses (including Set‑Cookie headers) to be cached and leaked, and a mixed qualified/unqualified private directive can trigger an uncaught TypeError, potentially crashing the process. This affects shared cache usage, which is the default configuration, making the vulnerability high‑risk.
Something like this might fix it:
For reference: rule
CVE-2026-13697. Rated high.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.