Skip to content

fix fetch path logic#4890

Merged
mcollina merged 1 commit intonodejs:mainfrom
KhafraDev:issue-4889
Mar 14, 2026
Merged

fix fetch path logic#4890
mcollina merged 1 commit intonodejs:mainfrom
KhafraDev:issue-4889

Conversation

@KhafraDev
Copy link
Copy Markdown
Member

@KhafraDev KhafraDev commented Mar 13, 2026 •
edited
Loading

fixes #4889

This relates to...

Rationale

Changes

Features

Bug Fixes

Breaking Changes and Deprecations

Status

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Mar 13, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.95%. Comparing base (a95556d) to head (84e88cc).
⚠️ Report is 23 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #4890      +/-   ##
==========================================
- Coverage   93.14%   92.95%   -0.20%     
==========================================
  Files         109      112       +3     
  Lines       34254    35665    +1411     
==========================================
+ Hits        31907    33153    +1246     
- Misses       2347     2512     +165

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

mcollina
mcollina approved these changes Mar 14, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgmt

@mcollina mcollina merged commit 3a05a4f into nodejs:main Mar 14, 2026
36 of 37 checks passed
@domenic
Copy link
Copy Markdown
Contributor

domenic commented Mar 14, 2026

FWIW #4892 seems likely to be a better fix, as it doesn't mess around with unrelated parts of the URL when trying to figure out the path? Like, what if the host is h, then url.href.indexOf("h") will return 0?

mergify bot added a commit to ArcadeData/arcadedb that referenced this pull request Mar 14, 2026
@mergify
chore(deps-dev): bump undici from 7.22.0 to 7.24.2 in /e2e-studio [sk…
bea7786 
…ip ci]

Bumps [undici](https://github.com/nodejs/undici) from 7.22.0 to 7.24.2.
Release notes

*Sourced from [undici's releases](https://github.com/nodejs/undici/releases).*

> v7.24.2
> -------
>
> What's Changed
> --------------
>
> * fix fetch path logic by [`@​KhafraDev`](https://github.com/KhafraDev) in [nodejs/undici#4890](https://redirect.github.com/nodejs/undici/pull/4890)
> * remove maxDecompressedMessageSize by [`@​KhafraDev`](https://github.com/KhafraDev) in [nodejs/undici#4891](https://redirect.github.com/nodejs/undici/pull/4891)
>
> **Full Changelog**: <nodejs/undici@v7.24.1...v7.24.2>
>
> v7.24.1
> -------
>
> What's Changed
> --------------
>
> * fix: **proto** pollution by [`@​rahulyadav5524`](https://github.com/rahulyadav5524) in [nodejs/undici#4885](https://redirect.github.com/nodejs/undici/pull/4885)
>
> **Full Changelog**: <nodejs/undici@v7.24.0...v7.24.1>
>
> v7.24.0
> -------
>
> Undici v7.24.0 Security Release Notes
> =====================================
>
> This release addresses multiple security vulnerabilities in Undici.
>
> Upgrade guidance
> ----------------
>
> All users on v7 should upgrade to **v7.24.0** or later.
>
> Fixed advisories
> ----------------
>
> * [GHSA-2mjp-6q6p-2qxm](GHSA-2mjp-6q6p-2qxm) / CVE-2026-1525 (Medium)  
>   Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
> * [GHSA-f269-vfmq-vjvj](GHSA-f269-vfmq-vjvj) / CVE-2026-1528 (High)  
>   Malicious WebSocket 64-bit frame length handling could crash the client.
> * [GHSA-phc3-fgpg-7m6h](GHSA-phc3-fgpg-7m6h) / CVE-2026-2581 (Medium)  
>   Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
> * [GHSA-4992-7rv2-5pvq](GHSA-4992-7rv2-5pvq) / CVE-2026-1527 (Medium)  
>   CRLF injection via the `upgrade` option.
> * [GHSA-v9p9-hfj2-hcw8](GHSA-v9p9-hfj2-hcw8) / CVE-2026-2229 (High)  
>   Unhandled exception from invalid `server_max_window_bits` in WebSocket permessage-deflate negotiation.
> * [GHSA-vrm6-8vpv-qv8q](GHSA-vrm6-8vpv-qv8q) / CVE-2026-1526 (High)  
>   Unbounded memory consumption in WebSocket permessage-deflate decompression.
>
> Affected and patched ranges
> ---------------------------
>
> * CVE-2026-1525: affected `7.0.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-1528: affected `7.0.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-2581: affected `>= 7.17.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-1527: affected `7.0.0 < 7.24.0`, patched `7.24.0`

... (truncated)


Commits

* [`f2e155b`](nodejs/undici@f2e155b) Bumped v7.24.2
* [`4d2d1af`](nodejs/undici@4d2d1af) remove maxDecompressedMessageSize ([#4891](https://redirect.github.com/nodejs/undici/issues/4891))
* [`3a05a4f`](nodejs/undici@3a05a4f) fix fetch path logic ([#4890](https://redirect.github.com/nodejs/undici/issues/4890))
* [`23e3cd3`](nodejs/undici@23e3cd3) Bumped v7.24.1
* [`3aedaa8`](nodejs/undici@3aedaa8) remove PLAN.md
* [`0d7ec33`](nodejs/undici@0d7ec33) fix: **proto** pollution ([#4885](https://redirect.github.com/nodejs/undici/issues/4885))
* [`07a3906`](nodejs/undici@07a3906) Bumped v7.24.0 ([#4887](https://redirect.github.com/nodejs/undici/issues/4887))
* [`74495c6`](nodejs/undici@74495c6) fix: reject duplicate content-length and host headers
* [`84235c6`](nodejs/undici@84235c6) Fix websocket 64-bit length overflow
* [`77594f9`](nodejs/undici@77594f9) fix: validate upgrade header to prevent CRLF injection
* Additional commits viewable in [compare view](nodejs/undici@v7.22.0...v7.24.2)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=undici&package-manager=npm\_and\_yarn&previous-version=7.22.0&new-version=7.24.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArcadeData/arcadedb/network/alerts).
mergify bot added a commit to ArcadeData/arcadedb that referenced this pull request Mar 14, 2026
@mergify
chore(deps-dev): bump undici from 7.22.0 to 7.24.2 in /e2e-js [skip ci]
56f7c8d 
Bumps [undici](https://github.com/nodejs/undici) from 7.22.0 to 7.24.2.
Release notes

*Sourced from [undici's releases](https://github.com/nodejs/undici/releases).*

> v7.24.2
> -------
>
> What's Changed
> --------------
>
> * fix fetch path logic by [`@​KhafraDev`](https://github.com/KhafraDev) in [nodejs/undici#4890](https://redirect.github.com/nodejs/undici/pull/4890)
> * remove maxDecompressedMessageSize by [`@​KhafraDev`](https://github.com/KhafraDev) in [nodejs/undici#4891](https://redirect.github.com/nodejs/undici/pull/4891)
>
> **Full Changelog**: <nodejs/undici@v7.24.1...v7.24.2>
>
> v7.24.1
> -------
>
> What's Changed
> --------------
>
> * fix: **proto** pollution by [`@​rahulyadav5524`](https://github.com/rahulyadav5524) in [nodejs/undici#4885](https://redirect.github.com/nodejs/undici/pull/4885)
>
> **Full Changelog**: <nodejs/undici@v7.24.0...v7.24.1>
>
> v7.24.0
> -------
>
> Undici v7.24.0 Security Release Notes
> =====================================
>
> This release addresses multiple security vulnerabilities in Undici.
>
> Upgrade guidance
> ----------------
>
> All users on v7 should upgrade to **v7.24.0** or later.
>
> Fixed advisories
> ----------------
>
> * [GHSA-2mjp-6q6p-2qxm](GHSA-2mjp-6q6p-2qxm) / CVE-2026-1525 (Medium)  
>   Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
> * [GHSA-f269-vfmq-vjvj](GHSA-f269-vfmq-vjvj) / CVE-2026-1528 (High)  
>   Malicious WebSocket 64-bit frame length handling could crash the client.
> * [GHSA-phc3-fgpg-7m6h](GHSA-phc3-fgpg-7m6h) / CVE-2026-2581 (Medium)  
>   Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
> * [GHSA-4992-7rv2-5pvq](GHSA-4992-7rv2-5pvq) / CVE-2026-1527 (Medium)  
>   CRLF injection via the `upgrade` option.
> * [GHSA-v9p9-hfj2-hcw8](GHSA-v9p9-hfj2-hcw8) / CVE-2026-2229 (High)  
>   Unhandled exception from invalid `server_max_window_bits` in WebSocket permessage-deflate negotiation.
> * [GHSA-vrm6-8vpv-qv8q](GHSA-vrm6-8vpv-qv8q) / CVE-2026-1526 (High)  
>   Unbounded memory consumption in WebSocket permessage-deflate decompression.
>
> Affected and patched ranges
> ---------------------------
>
> * CVE-2026-1525: affected `7.0.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-1528: affected `7.0.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-2581: affected `>= 7.17.0 < 7.24.0`, patched `7.24.0`
> * CVE-2026-1527: affected `7.0.0 < 7.24.0`, patched `7.24.0`

... (truncated)


Commits

* [`f2e155b`](nodejs/undici@f2e155b) Bumped v7.24.2
* [`4d2d1af`](nodejs/undici@4d2d1af) remove maxDecompressedMessageSize ([#4891](https://redirect.github.com/nodejs/undici/issues/4891))
* [`3a05a4f`](nodejs/undici@3a05a4f) fix fetch path logic ([#4890](https://redirect.github.com/nodejs/undici/issues/4890))
* [`23e3cd3`](nodejs/undici@23e3cd3) Bumped v7.24.1
* [`3aedaa8`](nodejs/undici@3aedaa8) remove PLAN.md
* [`0d7ec33`](nodejs/undici@0d7ec33) fix: **proto** pollution ([#4885](https://redirect.github.com/nodejs/undici/issues/4885))
* [`07a3906`](nodejs/undici@07a3906) Bumped v7.24.0 ([#4887](https://redirect.github.com/nodejs/undici/issues/4887))
* [`74495c6`](nodejs/undici@74495c6) fix: reject duplicate content-length and host headers
* [`84235c6`](nodejs/undici@84235c6) Fix websocket 64-bit length overflow
* [`77594f9`](nodejs/undici@77594f9) fix: validate upgrade header to prevent CRLF injection
* Additional commits viewable in [compare view](nodejs/undici@v7.22.0...v7.24.2)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=undici&package-manager=npm\_and\_yarn&previous-version=7.22.0&new-version=7.24.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArcadeData/arcadedb/network/alerts).
@guoyangzhen guoyangzhen mentioned this pull request Mar 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollina mcollina mcollina approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

url.href.slice(url.origin.length) path extraction breaks when URL contains credentials

4 participants

@KhafraDev @codecov-commenter @domenic @mcollina