NousResearch/hermes-agent

Cap unbounded HTTP response reads in OIDC auth

Cluster 55121 · dashboard. Data as of 2026-10-26 12:29 UTC

1 open item. Fix merged in #133938 on 6 Oct 2026. Check it covers your case.

open issue

open PRs

items grouped

Known?: Yes. 3 related items grouped here, 0 issues already closed.
Fix event: A fix was merged to main in PR #133938. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open: 1 issue and 0 PRs.

Next step: read #133938, then check whether your report is the one still open.

Read #133938 Pick up a Lab task

These items address a vulnerability where self-hosted OIDC identity provider responses were read without a size limit. The fix introduces a cap on HTTP JSON response body reads in the dashboard authentication flow.

Open issues1

Issue#55121Dashboard self-hosted OIDC buffers unbounded IDP responses

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#133938 fix(dashboard+auth): cap HTTP JSON response body reads

merged to main

files: hermes_cli/web_routers/audio.py, hermes_cli/web_server_gateway.py, plugins/dashboard_auth/_shared.py, plugins/dashboard_auth/self_hosted/__init__.py, tests/hermes_cli/test_audio_router_scope.py, tests/hermes_cli/test_web_server.py, tests/hermes_cli/test_web_server_gateway_health.py, tests/plugins/dashboard_auth/test_nous_provider.py, tests/plugins/dashboard_auth/test_self_hosted_provider.py

1 PR closed without merging

From the close comments: superseded by another PR 1

#55122 fix(dashboard-auth): bound self-hosted OIDC responses · superseded by another PR

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem: dashboard
Merged PRs: #133938
Closed issues: 0
Attempts: 1 PR closed without merging
Fix link checked: 6 Oct 2026

For your agent

The same facts, typed.

cluster/55121.json
cluster/55121.md