Tools
A Bun packaging quirk left a vulnerable undici in Cline after the CVE was supposedly remediated
v3.0.62 collapses a nested [redacted] (CVE-2026-1525) onto 7.x, noting that the earlier remediation's version-scoped override key was silently ignored by Bun, so a vulnerable copy survived the first fix. This is a concrete instance of a fix that verified as applied at the manifest level while the dependency tree still shipped the old code. Anyone pinning transitive dependencies through Bun overrides should check whether their own override keys are actually taking effect rather than trusting the lockfile diff.
Source
↳ Follow the thread