Acknowledgements

Special thanks to Xiang Li for reporting the vulnerability.

Security

• New configuration object PendingRequestsConfig for configuring the cache poisoning attack mitigation. By default, proxy.Proxy will now track all simultaneous duplicate requests, and only perform a single lookup for them.