Coop 1.2.1

Important

This release addresses two reported security advisories: GHSA-c3r3-vg94-mqrx (High, CVSS 7.5) and GHSA-75wr-5gj4-p3cx (High, CVSS 7.5). All deployments should upgrade. For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

Coop's API server uses the Express body-parser middleware, which is affected by CVE-2026-111181: a single malformed compressed request body can crash the server process. All versions of Coop up to and including 1.2.0 are affected. This release updates body-parser to 2.4.0. See the Express announcement for details.

Coop's server and worker also make outbound requests with undici, which is affected by CVE-2026-87018 and CVE-2026-109869: a server that Coop fetches content from, such as an image or audio URL in a submitted item, can crash the server or worker process. This release updates undici to 7.30.1.

The risk is a denial of service: an attacker who can send HTTP requests to Coop's API, or get Coop to fetch a URL they control, can repeatedly crash it. Deployments that expose Coop's API beyond a trusted network are most at risk. We recommend all deployments upgrade.

Thanks to @serendipty01 for reporting the body-parser issue (GHSA-c3r3-vg94-mqrx) and preparing its fix.

Other security updates

• HMA base image: Meta has moved the HMA image from ghcr.io/facebook to ghcr.io/meta, and an unknown actor has taken over the old facebook name. Do not build HMA from 1.2.0 or earlier. This release pins ghcr.io/meta/threatexchange/hma:1.2.1 by digest (#1452, #1498 by @juanmrad, #1503 by @reitblatt).

Upstream advisories that don't affect Coop

The updates in this release also fix these upstream advisories. They're in code that Coop doesn't use, so they don't affect Coop:

• undici 7.30.1 (the GHSA-75wr-5gj4-p3cx fix above) also fixes CVE-2026-109383 and CVE-2026-109829 (High); CVE-2026-109932, CVE-2026-87029, CVE-2026-109924 and CVE-2026-109841 (Moderate) (#1464).
• follow-redirects 1.16.1 fixes CVE-2026-111755 and CVE-2026-111756 (High) (#1457, @reitblatt).
• markdown-it 14.3.3 fixes CVE-2026-111758 (High) and CVE-2026-111766 (Low) (#1457, #1467).

Upgrade notes

This is a patch release on the 1.2 series: it contains only the security updates above, with no migrations or behavior changes.

• Images: ghcr.io/roostorg/coop-server:1.2.1, coop-worker:1.2.1, coop-client:1.2.1 and coop-migrations:1.2.1.
• If you build HMA yourself, rebuild it from this release's hma/Dockerfile, or point your own build at ghcr.io/meta/threatexchange/hma:1.2.1 (sha256:a89c941da57436bc944abce42d9e6d2d757fcc539118e2f3fcafd24ae1bcc3dd).

Full Changelog: 1.2.0...1.2.1