https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:48:22.299796+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-159996 EUVD-2026-159996 2026-10-03T01:48:22.377105+00:00 EUVD-2026-159996 https://cve.radiocsirt.org/vuln/fkie_cve-2023-7078 fkie_cve-2023-7078 2026-10-03T01:48:22.377163+00:00

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

 https://cve.radiocsirt.org/vuln/ghsa-fwvg-2739-22v7 GHSA-fwvg-2739-22v7 — Miniflare vulnerable to Server-Side Request Forgery (SSRF) 2026-10-03T01:48:22.377221+00:00

Affected: npm: miniflare

### Impact Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers.

### Patches The issue was fixed in `miniflare@3.20231030.2`.

### Workarounds Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: "127.0.0.1"` option.

### References - https://github.com/cloudflare/workers-sdk/pull/4532

 https://cve.radiocsirt.org/vuln/gsd-2023-7078 gsd-2023-7078 2026-10-03T01:48:22.377279+00:00 gsd-2023-7078