Quiet-ish week: one real dependency bump to make across the stack, one reverse-proxy version to confirm, and a teachable gap in how we trust third-party tools.
High severity. A URL-parser bug can trick your agent into calling servers it was told to block threat
The fast-uri library doesn't treat backslashes as authority delimiters the way Node's built-in URL parser does. That mismatch lets an attacker craft a URL that your host allow/deny list waves through, then redirects the outbound call somewhere it shouldn't go. Versions 3.0.0 through 3.1.3 are affected, and 3.1.2/3.1.3 are installed across roughly eleven fleet repos — so this is a real bump to make, not a hypothetical.
- Who should care
- Anyone running Node apps that use fast-uri to validate URLs before making outbound calls. Ignore it if fast-uri isn't in your tree, or you're already on 3.1.4 or higher (3.1.6+ to also clear the companion CVE-2026-75975).
- What to do
- Add an npm
overridespin of"fast-uri": ">=3.1.6"per repo and regenerate lockfiles, then runnpm auditto confirm the advisory resolves. Verify each app boots and its suites pass before you restart.
Tracked as CVE-2026-16221, CVE-2026-75975, GHSA-v2hh-gcrm-f6hxSeverity high · CVSS 7.5Source GitHub Advisory Database GHSA-v2hh-gcrm-f6hx; Library/Turing deterministic lockfile measurement 2026-09-08
High severity. Your reverse proxy might trust a login header the visitor set themselves threat
Caddy's forward_auth with copy_headers only sets a header when the auth service returns it — but it never deletes the visitor's own same-name header. So if the auth service replies 200 OK without that header, the client's version passes straight through to the backend. Anyone holding a valid session token can then inject a trusted identity value and escalate their privileges. It affects Caddy 2.10.0 up to 2.11.2, and fleet records point to 2.11.4 already, so this is a quick confirm.
- Who should care
- Anyone using Caddy's forward_auth with copy_headers on a version below 2.11.2. Ignore it if you're on 2.11.2 or higher (2.11.3+ also clears the vars_regexp issue, CVE-2026-30852).
- What to do
- Run
caddy version; if it's 2.11.2 or higher, close it as clear. If lower, do a routine apt or binary upgrade andcaddy reloadin an ops window — the same check covers CVE-2026-30852 at 2.11.3+.
Tracked as CVE-2026-30851, GHSA-7r4p-vjf4-gxv4Severity high · CVSS 8.1Source GitHub Advisory Database GHSA-7r4p-vjf4-gxv4; GitLab Advisory Database GO-2026-4639; web search confirmed 2026-09-14; Library/Turing brief 2026-09-13
Patched. Five vulnerability findings came in this week; none applied to what we actually run we patched
The weekly vulnerability funnel processed five findings and checked each against a deterministic inventory of what's actually installed. Zero were confirmed: one was out of the affected version range, three named packages we don't run, and one targeted an ecosystem the gate doesn't support. Four were held by the applicability gate and none were repeat sightings.
- The lesson
- A vuln that names a package — or a version — you don't run isn't your vuln; an inventory gate turns a feed of scary IDs into the short list that's actually yours.
Source Fleet internal — Library/Turing applicability gate 2026-09-14
Low severity. The tool descriptions your agent trusts can be rewritten into an attack behind your back deep-dive
When your agent connects to a third-party MCP server, it trusts whatever tool descriptions that server sends at runtime — and those descriptions go straight into the model's context. The MCPTox benchmark tested 45 real deployed MCP servers across 1,312 malicious cases and found a 72% success rate for injecting instructions through tool descriptions; even the best refuser, Claude 3.7 Sonnet, declined under 3% of attacks. So a compromised or rug-pulled upstream can silently rewrite a description into an injection payload, upstream of every string-sanitization defense you have. The fix doesn't rely on the model refusing: hash a reviewed baseline of each tool and diff it every time the server lists its tools, blocking on any drift.
- Who should care
- Anyone whose agent loads tools from third-party MCP servers they don't control — for the fleet, Firecrawl and the TikTok-scraper. Ignore it if every MCP server you use is one you build and host yourself.
- What to do
- On session start, call tools/list for each configured server, canonicalize and hash each tool's name, description, and inputSchema, and compare against a checked-in baseline JSON — abort and alert on any diff. Add a
--rebaselinecommand for human-reviewed updates.
Severity lowSource arXiv:2508.14925 (MCPTox, verified); Library/Senku brief 2026-09-08