# Security changelog 1.5.0

Vulnerabilities fixed since version 1.4.1.

Fixed: 16

| Vulnerability | Severity | Package (previous version) | Platform | Summary |
|---|---|---|---|---|
| [CVE-2026-19534](https://nvd.nist.gov/vuln/detail/CVE-2026-19534) | 7.5 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| [CVE-2026-84961](https://nvd.nist.gov/vuln/detail/CVE-2026-84961) | 7.4 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
| [CVE-2026-84933](https://nvd.nist.gov/vuln/detail/CVE-2026-84933) | 6.5 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
| [CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911) | 6.3 | npm/ip-address@10.7.0 | arm64, x64 | ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process |
| [CVE-2026-101912](https://nvd.nist.gov/vuln/detail/CVE-2026-101912) | 6.3 | npm/ip-address@10.7.0 | arm64, x64 | ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range |
| [CVE-2026-17495](https://nvd.nist.gov/vuln/detail/CVE-2026-17495) | 5.9 | npm/moment@2.30.1 | arm64, x64 | moment vulnerable to Path Traversal via crafted non-string locale name |
| [CVE-2026-18149](https://nvd.nist.gov/vuln/detail/CVE-2026-18149) | 5.9 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to Denial of Service via orphaned RetryHandler response body |
| [CVE-2026-84890](https://nvd.nist.gov/vuln/detail/CVE-2026-84890) | 5.9 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
| [CVE-2026-85014](https://nvd.nist.gov/vuln/detail/CVE-2026-85014) | 5.9 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to Denial of Service via WebSocketStream unclean close |
| [CVE-2026-85024](https://nvd.nist.gov/vuln/detail/CVE-2026-85024) | 5.9 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
| [CVE-2026-87859](https://nvd.nist.gov/vuln/detail/CVE-2026-87859) | 5.3 | npm/morgan@1.12.0 | arm64, x64 | morgan vulnerable to Log Injection via unescaped double quote in quoted log fields |
| [CVE-2026-88932](https://nvd.nist.gov/vuln/detail/CVE-2026-88932) | 5.3 | npm/multer@2.3.0 | arm64, x64 | multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads |
| [CVE-2026-86472](https://nvd.nist.gov/vuln/detail/CVE-2026-86472) | 4.8 | npm/fast-uri@3.1.7 | arm64, x64 | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
| [CVE-2026-18540](https://nvd.nist.gov/vuln/detail/CVE-2026-18540) | 3.7 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to downstream response splitting via retry interceptor |
| [CVE-2026-84947](https://nvd.nist.gov/vuln/detail/CVE-2026-84947) | 3.7 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
| [CVE-2026-85008](https://nvd.nist.gov/vuln/detail/CVE-2026-85008) | 3.7 | npm/undici@7.29.0 | arm64, x64 | undici vulnerable to caching and replay of unsafe HTTP method responses |