[Security] Cache deduplication key collision via unescaped delimiters

[eddieran]

Summary

makeDeduplicationKey in lib/util/cache.js:376 constructs keys using : and = delimiters without escaping header names or values. Different header sets can produce identical keys, causing response confusion when the deduplicate interceptor is enabled.

Reproduction

Headers {a:"x:b=y"} produces the same dedup key as {a:"x", b:"y"}:

• Key 1: GET:https://example.com:a=x:b=y
• Key 2: GET:https://example.com:a=x:b=y

Both are identical despite different header sets.

Impact

When cache deduplication is used, concurrent requests with colliding keys share a dedup slot, potentially receiving the wrong response. Impact depends on what headers differ (auth headers, content negotiation, etc).

Suggested Fix

Escape : and = in header names/values before key construction, or use a collision-resistant format (e.g., JSON.stringify sorted entries, or length-prefixed encoding).

Affected Component

Deduplicate interceptor (lib/util/cache.js)

---

Found during automated security audit.

[metcoder95]

The correction to the behaviour is welcomed, but I doubt that this can categorized as security

[eddieran]

That's fair — the security impact is indeed limited since it requires specific cache configurations. Thanks for merging the fix regardless, appreciated!