Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

github/fetch

              main @ ba5cf1e
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Information Disclosure: 1 prior fix. Scrutinize any change in this area.

fetch.js: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: In environment-specific runtimes like React Native, the default behavior of the underlying XMLHttpRequest client may default to sending credentials. When the user explicitly requests to omit credentials, this configuration can be ignored, leading to silent, unintended exposure of session cookies.

Integer Overflow: Legacy protocol parsing of HTTP headers was susceptible to integer overflows when processing malicious remote server responses, leading to memory corruption and potential arbitrary code execution.