Additional changes to review1 matched termMatched wording:no longerThese matches may be harmless in context. Expand to see the excerpts.
- The changelog contains the phrase “no longer”; its impact needs context.
withXSRFTokenTruthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
🔒 Security Fixes
- Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
- CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
- Prototype Pollution / Auth Bypass: Replaced unsafe
inchecks withhasOwnPropertyto prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760) withXSRFTokenTruthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. ()