Release Notes

QualityChecks Release Notes - v1.3.2

Release Status

Version 1.3.2 is a patch release focused on dependency security updates.

This release includes:

• Updated undici to 7.29.0 to fix cache disclosure and parse-time crash vulnerabilities
• Updated fast-uri to 3.1.5 to fix host confusion vulnerability
• Updated dompurify to 3.4.13 to fix IN_PLACE hook XSS vulnerability
• Updated js-yaml to 5.2.1 to fix CVE-2026-59870 quadratic CPU denial of service

Summary

QualityChecks v1.3.2 applies critical security patches to transitive dependencies via npm package overrides.

Included in v1.3.2

Dependency Security Updates

• undici 7.29.0: Fixes two security issues in the cache interceptor:

  • Malformed Cache-Control: private directives (e.g., private="") can be incorrectly stored in shared cache and served to later callers, disclosing private response bodies and headers including Set-Cookie.
  • Mixed unqualified-and-qualified private directives cause an uncaught TypeError that can terminate the request.

• fast-uri 3.1.5: Fixes host confusion vulnerability via backslash authority introducer:

  • Prevents policy bypass where fast-uri parses backslash-prefixed URIs (e.g., \\evil.com) differently from Node's WHATWG URL parser, allowing unintended destinations when host-based policy is enforced.

• dompurify 3.4.13: Fixes IN_PLACE hook XSS vulnerability:

  • During IN_PLACE sanitization, a hook that removes an element no longer leaves detached descendants executable.
  • Prevents XSS where an attacker-provided onload handler on a descendant resource element could fire after sanitize() returns, even though the returned root is clean.

• js-yaml 5.2.2: Fixes two critical parsing vulnerabilities:

  • CVE-2026-59870: O(n²) quadratic CPU consumption in !!omap resolution (now O(n) with Set-based deduplication)
  • Exponential parsing time in flow collections: Fixes O(2^n) parsing time when deeply nested flow sequences contain key-value pairs, preventing denial of service attacks with small payloads under 200 bytes

Fixed in v1.3.2

• Fixed undici cache disclosure vulnerability that could leak private response data to unintended callers.
• Fixed undici parse-time crash from malformed Cache-Control directives.
• Fixed fast-uri host confusion that could bypass URL policy validation (allowlists, denylists, SSRF filtering).
• Fixed dompurify IN_PLACE hook vulnerability where detached elements could retain and execute event handlers after sanitization.
• Fixed js-yaml CVE-2026-59870 denial of service from quadratic CPU consumption when parsing !!omap sequences with many entries.

Upgrade Notes

• No application code changes; dependency updates only.
• npm package overrides now pin:
  • undici to 7.29.0
  • fast-uri to 3.1.5
  • dompurify to 3.4.13 (direct dependency)
  • js-yaml to 5.2.2

---