Coop 1.2.1

[reitblatt]

Important

This release addresses a reported security advisory: GHSA-c3r3-vg94-mqrx (High, CVSS 7.5). All deployments should upgrade. For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

Coop's API server uses the Express body-parser middleware, which is affected by CVE-2026-111181: a single malformed compressed request body can crash the server process. All versions of Coop up to and including 1.2.0 are affected. This release updates body-parser to 2.4.0. See the Express announcement for details.

The risk is a denial of service: an attacker who can send HTTP requests to Coop's API can repeatedly crash it. Deployments that expose Coop's API beyond a trusted network are most at risk. We recommend all deployments upgrade.

Thanks to @serendipty01 for reporting this and preparing the fix.

Other security updates

High

• undici 7.30.1 in the server and worker images fixes CVE-2026-109383, CVE-2026-109829, CVE-2026-87018 and CVE-2026-109869 (#1464).
• follow-redirects 1.16.1 in the server and worker images fixes CVE-2026-111755 and CVE-2026-111756 (#1457, @reitblatt).
• markdown-it 14.3.3 in the client image fixes CVE-2026-111758 (#1457, #1467).

Moderate

• undici 7.30.1 also fixes CVE-2026-109932, CVE-2026-87029, CVE-2026-109924 and CVE-2026-109841 (#1464).

Low

• markdown-it 14.3.3 also fixes CVE-2026-111766 (#1457, #1467).

No advisory

• HMA base image: Meta has moved the HMA image from ghcr.io/facebook to ghcr.io/meta, and the facebook organization name on GitHub is no longer Meta's. Coop 1.2.0's hma/Dockerfile still points at ghcr.io/facebook/threatexchange/hma:1.2.0, so don't build HMA from 1.2.0 or earlier. This release builds from ghcr.io/meta/threatexchange/hma:1.2.1, pinned by digest (#1452, #1498 by @juanmrad, #1503 by @reitblatt).

Upgrade notes

This is a patch release on the 1.2 series: it contains only the security updates above, with no migrations or behavior changes.

• Images: ghcr.io/roostorg/coop-server:1.2.1, coop-worker:1.2.1, coop-client:1.2.1 and coop-migrations:1.2.1.
• If you build HMA yourself, rebuild it from this release's hma/Dockerfile, or point your own build at ghcr.io/meta/threatexchange/hma:1.2.1 (sha256:a89c941da57436bc944abce42d9e6d2d757fcc539118e2f3fcafd24ae1bcc3dd).

Full Changelog: 1.2.0...1.2.1

---

This discussion was created from the release Coop 1.2.1.