Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementation
Undici advisories overlap exact runtime pins, including the local Web Fetch implementation. Upstream published the SRI advisory on 2026-10-15T15:59:40Z, EventSource on 2026-10-15T16:01:04Z, and fetch crash on 2026-10-15T16:01:26Z, before rc.1, rc.2 and rc.3. Their global Advisory Database entries followed on 2026-10-23 at 22:12:57Z, 22:13:29Z and 22:14:31Z respectively. The directly relevant fetch advisory describes a process-terminating unhandled stream error when a malicious server sends excessive content codings and closes early, even when the application catches the fetch rejection. Unbounded EventSource parser state can exhaust memory; skipped integrity checks for mixed-case SRI algorithm tokens can accept a response body that does not match its intended digest. All overlap the 8.11.2 pin; the latter two require call-site conditions not established here. The 8.x fixed version is 8.12.2.
Channel: preview-or-beta. Half: defect. Date: 2026-10-15.
Operator consequence: Treat remote response handling as a dependency review item, not just a URL-allowlist problem. The tagged local fetch path reaches the affected library; public-IP checks and manual redirect handling do not by themselves repair response decoding. Require a resolved dependency update and a bounded regression check before declaring this closed. No process-crash payload was run, and no claim is made that every advisory is exploitable through every DSH route.
Receipt
- https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
- https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
- https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472
- https://github.com/advisories/GHSA-xjj6-f33q-929c
- https://github.com/advisories/GHSA-4qv8-2p9j-2685
- https://github.com/advisories/GHSA-f72v-6w45-q472
- https://github.com/deepseek-ai/deepseek-harness/blob/1f81c047fc48fa190a683e469daa699857e9afe8/packages/web/web-fetch-http/package.json
- https://github.com/deepseek-ai/deepseek-harness/blob/1f81c047fc48fa190a683e469daa699857e9afe8/packages/web/web-fetch-http/src/network.ts#L192-L238
- https://registry.npmjs.org/@deepseek-ai%2Fdsh-web-fetch-http/0.2.1-rc.3
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementation
Profile citations
- deepseek-harness / claim / undici-fetch-affected-pin
Source links
Primary links, including exact changelog lines when available.
- official docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929cofficial docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685official docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472official docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/advisories/GHSA-xjj6-f33q-929cofficial docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/advisories/GHSA-4qv8-2p9j-2685official docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationgithub.com/advisories/GHSA-f72v-6w45-q472tagged commit file2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationdeepseek-ai/deepseek-harness / packages/web/web-fetch-http/package.jsontagged commit file2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationdeepseek-ai/deepseek-harness / packages/web/web-fetch-http/src/network.ts#L192-L238official docs2026-10-24-deepseek-harness-undici-advisories-overlap-exact-runtime-pins-including-the-local-web-fetch-implementationregistry.npmjs.org/@deepseek-ai%2Fdsh-web-fetch-http/0.2.1-rc.3
Versioned source: run artifact