undici, the HTTP client behind Node.js's global fetch, fixed eight flaws on its 6.x, 7.x and 8.x lines yesterday, and no Node.js release carries the fixes yet. Xinference disclosed a 9.8 that 3.5.0 fixed three weeks ago, the Archon AI coding agent has an unauthenticated 9.8 with no fix, and Microsoft added a 7.5 to Tuesday's .NET servicing for the System.Formats.Cbor package.

No scanner raises these yet. All eight undici records, the Xinference record and the three MCP SDK records return 404 in GitHub's database, so npm audit, Dependabot and pip-audit stay quiet. Archon's and LightLLM's are unreviewed CVEs with no package mapping, and NuGet lists no vulnerability on any System.Formats.Cbor version.

Worth your morning

undici: eight fixes on three lines, and Node.js hasn't shipped them. undici (217 million downloads a week) published eight advisories at 15:57–16:01 UTC yesterday, after 6.29.1, 7.30.1 and 8.12.2 reached npm between 14:18 and 15:05. Two let a malicious server crash the Node.js process. One uses a response with more than five content codings that closes before the body, and it kills the process even when the application catches the fetch() rejection (CVE-2026-109869, 7.5). The other uses a TLS 1.2 renegotiation that presents a different certificate (CVE-2026-87018, 7.5). An agent whose fetch tool follows URLs chosen by a model or a user can reach either server. The two 7.4s: an Agent dropped a tls.checkServerIdentity callback before it reached the TLS layer, so certificate pinning written that way never ran, on every release back to 4.0.0 (CVE-2026-109383). On 7.x and 8.x, an originless Agent that combines the redirect and cache interceptors with a shared cache store could cache a cross-origin response under the trusted URL and serve it to later callers (CVE-2026-109829). The four mediums cover memory exhaustion in the WebSocket client and the EventSource parser, a crash in the decompress interceptor, and an integrity check that missed upper-case algorithm names.

Node.js bundles its own undici for the global fetch and WebSocket. Node 22.23.3 ships 6.28.1, 24.22.0 ships 7.29.1 and 26.12.0 ships 8.11.2, all inside the ranges. Pull requests updating all three lines are open (#66721, #66764, #66765), and no release carries them yet. Upgrading the undici package fixes code that imports it; code that calls the global fetch waits for Node. Run npm ls undici, because it often arrives as a transitive dependency.

Xinference: a 9.8 fixed three weeks before anyone said so. Xinference published GHSA-jv65 at 05:02 UTC today. Registering a custom model could mark it as built-in and skip the control over running a model repository's own code, which leads to code execution with the worker's privileges, root in the tested official image. The fix (PR 5530) merged on September 12 and shipped in 3.5.0 on September 25; 4.0.0 (October 9) has it too. The 9.8 assumes no credentials: 2.12.0 in its default setup, or 3.0 to 3.4 with XINFERENCE_AUTH_ADVANCED=0. Under 3.x's default advanced authentication, the caller needs models:register and models:write or an administrator credential, and still gets past the code-execution control. Releases before 2.12.0 predate that control, and the advisory says to upgrade them too. Upgrade every supervisor and worker. The Xinference floor moves from 2.7.0, set on August 22, to 3.5.0. Underneath, Xoscar's unauthenticated 9.8 from October 14 is still unfixed at 0.11.2, so keep the supervisor and worker ports off untrusted networks either way.

Archon: the agent's control API has no login and listens on every interface. VulnCheck filed CVE-2026-111322 (9.8; 9.3 on v4) at 00:31 UTC today against Archon (23,700 GitHub stars), 0.2.13 through 0.11.1. The /api/* control API needs no authentication, the server binds 0.0.0.0 unless HOST is set, and the coding agent behind it runs with bypassPermissions, so anyone who reaches the port can have it run commands as the Archon user. 0.11.1 (September 25) is the newest release, and the repository has no advisory or issue on it. The optional web login turns on only when both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET are set, SQLite installs can't enable it, and the record doesn't say whether it covers the control API. Set HOST=127.0.0.1 and reach Archon over SSH or a tunnel.

MCP TypeScript SDK: on the floor already, with two changes still to make. The SDK published three advisories at 13:10 UTC yesterday, all fixed in releases at or below the 1.32.0 floor set on October 3. The HTTP transports had no request-body or batch-length limit (GHSA-f897, 7.5), fixed on September 23 in sdk 1.30.1, server and node 2.1.0 and hono 2.0.1. Bodies over 4 MiB now get 413 and batches over 100 messages get 400. The other two need more than the upgrade. A single request under the size limit could still exhaust memory during validation (GHSA-46jr, 7.5). sdk 1.32.0 and server 2.3.0 add a maxToolInputElements option that is off by default, so set it just above your largest tool input and lower maxRequestBodySize to what your tools need. On 2.x, a shared McpServer or transport could deliver one HTTP client's messages to another (GHSA-jm63, 7.7). server 2.3.0 refuses to be shared, so an app built that way fails requests after the upgrade until it creates one server per request or keeps one server and transport per session. The same change fixes older versions. @modelcontextprotocol/sdk has 65 million downloads a week.

LightLLM: a second unfixed flaw on the same API. VulnCheck filed CVE-2026-111160 (7.5; 8.7 on v4) last night. One unauthenticated request to /generate that sets the internal pd_kv_trans_params field kills the inference thread while /health keeps answering, so every later request hangs until a restart. The report (issue 1629) went up yesterday with no reply, and v1.2.0 is still the newest tag, which also leaves the 9.8 on /pd_register from September 19 unfixed. Put an authenticating proxy in front that strips pd_kv_trans_params from request bodies, and use a liveness check that sends a small generation request, since /health won't notice.

System.Formats.Cbor: a .NET CVE two days after its fix. Microsoft published CVE-2026-109468 (7.5) yesterday under the ASP.NET Core tag: an unauthenticated attacker can exhaust resources over the network. MSRC lists the System.Formats.Cbor package as the fix, 8.0.1, 9.0.21 and 10.0.13, all published with Tuesday's servicing on October 13, plus Visual Studio 17.14.42 and 18.10.4. 8.0.1 is the package's first 8.x release since November 2023. MSRC marks it not exploited and not publicly disclosed. NuGet lists no vulnerability on any version and GitHub has no record, so NuGetAudit won't flag old references. NuGet restores the lowest version a package declares, so a project that gets System.Formats.Cbor through a library should reference the fixed version directly. The other 30 .NET entries Microsoft revised yesterday only gained .NET 11 KB links and Visual Studio download links; the fixed builds are unchanged.

Also on the AI stack.

• JetBrains Junie CLI CVE-2026-111091 (7.8): opening an untrusted project could run code through the project's MCP server configuration. Fixed in 26.8.3. That version number doesn't appear among the build numbers of the npm package @jetbrains/junie, so check the version the CLI itself reports.
• JeecgBoot GHSA-p3r5 (8.8): command injection in the MCP controller of its AI module, published by the repository at 05:48 UTC today. The record's range stops below 3.9.5 but names no fixed version, and 3.9.5 (August 27) is the newest release, so don't read the bound as a fix. Restrict access to the AI module's MCP endpoints to administrators.
• MONAI: a fifth repository advisory, GHSA-2wx3 (7.8, loading an untrusted Auto3DSeg algo_object.json), is fixed in 1.6.1, the floor since September 28. At the 1.6.1 tag the loader rejects such files instead of warning. Two August advisories this digest never covered have no fix: GHSA-636w (7.8), PersistentDataset loading pickled data from a shared cache_dir, and GHSA-h89g (7.0), a bypassable expression check in a shape helper. Both need local access. Keep cache_dir writable only by the user who runs the job.

Paperwork your scanner may raise. GitHub's reviewed feed indexed 61 records yesterday evening, 18:05 to 20:22 UTC.

• nginx-ui: thirteen records for the July MCP and secure-session fixes, four of them covered on October 13, are now in the database under the Go module path. All were fixed in July; the current release, 2.8.4, is well past them.
• Claude Code GHSA-pq7j (CVE-2026-86063), covered on October 10, is now in the database: below 2.1.179.
• MCP Python SDK CVE-2026-59951, covered on October 1 and yesterday, is now in the database. mcp 1.30.0 or 2.2.0 clears it.
• MessagePack for C#: CVE-2026-92707, covered on October 14 through the SignalR protocol record, now has its own record on the MessagePack package (GHSA-qhrr, below 2.5.303 and 3.x below 3.1.9), so NuGetAudit will start flagging direct references.
• NetLicensing MCP server CVE-2026-57496 (9.6) is a June advisory fixed in netlicensing-mcp 0.1.8 on June 18. The CVE arrived yesterday.
• unstructured CVE-2026-104250 (6.1, stored XSS in generated HTML) was fixed in 0.24.1 in July; 0.27.27 is current.

Standing items. SGLang 0.5.22 reached PyPI at 00:25 UTC today. io_struct.py still makes both _maybe_unwrap_pickle calls, so CVE-2026-93034 (9.8) stays open, and the five memory-exhaustion issues from October 13 are still open. n8n shipped 2.43.6 and 2.44.2 and the GitLab MCP server shipped 2.3.1, none with new advisories. Unchanged since yesterday: Xoscar 0.11.2, Kubeflow Model Registry 0.3.17, vLLM 0.31.0 (PR 51504 merged, in no release), LiteLLM 1.105.1 stable (CVE-2026-93355 open on JWT auth), Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp 5.2.0, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, mistral.rs 0.9.4, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, AstronRPA 1.1.6, Mooncake 0.3.13.post1, pandas-ai 3.0.0, mcp-remote 0.15.1 and GPT-SoVITS 20250606v2pro. BrowserSkill PR 363 is unmerged, @deepseek-ai/dsh-client-connection's latest tag still points at the affected 0.0.1-rc.1, and hyper-mcp has only nightly builds after 0.8.3. No Angular or PrimeNG advisories today.