Summary by cubic

Refreshes THREATMODEL.md to document recently shipped hardening and clarify residual risks, covering multipart per‑part header injection defenses, read‑side prototype‑pollution gadgets, stricter NO_PROXY parsing, decompression limits (including stream responses), and a new form‑data recursion DoS limit.

Description

Use this section for review hints, explanations or discussion points.

• Summary of changes
  • T-R3: Added multipart per‑part header injection coverage; documented formDataToStream CRLF/name sanitization.
  • T-R4: Split into write‑side and new read‑side gadgets (T‑R4b); noted hasOwnProp guards in mergeConfig, defaults, adapters, and config resolution.
  • T-R5: Clarified decompression bomb protections for buffered and responseType: 'stream'; noted request‑side limits and the redirect edge case fix.
  • T-R9: Hardened NO_PROXY handling for CIDR, IPv6 literals, and wildcards.
  • T-R11: Added form‑data recursion DoS with formSerializer.maxDepth default and error behavior.
  • Non‑goals: Narrowed to “fully compromised caller,” while noting defenses for polluted prototypes from transitive deps.
  • Supply chain: Updated T‑S1/T‑S6 gaps (path‑scoped CODEOWNERS); refreshed the risk summary table.
• Reasoning
  • Keep the threat model aligned with shipped mitigations and current behavior.
• Additional context
  • References GHSA fixes where relevant. Docs‑only; no runtime changes.

Docs

• Cross‑link /docs/pages/misc/security.md to the updated sections in THREATMODEL.md.
• Document formSerializer.maxDepth in:
  • /docs/pages/advanced/multipart-form-data-format.md
  • /docs/pages/advanced/x-www-form-urlencoded-format.md
• Add a short “Security limits” snippet (maxContentLength/maxBodyLength) to the Node usage page and link to the threat model.

Testing

• No tests added or modified (documentation‑only).
• No additional tests needed.

Semantic version impact

• No code changes. No release required.

^{Written for commit 24cddeb. Summary will update on new commits.}