https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T18:30:54.226563+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-271142 EUVD-2026-271142 2026-10-09T18:30:54.250726+00:00 EUVD-2026-271142 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27818 fkie_cve-2026-27818 2026-10-09T18:30:54.250769+00:00

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-w789-49fc-v8hr GHSA-w789-49fc-v8hr — TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist 2026-10-09T18:30:54.250812+00:00

Affected: npm: terriajs-server

### Impact A validation bug allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration.

The validation only checks if a hostname _ended_ with an allowed domain. This meant:

If `example.com` is allowed in `proxyableDomains`:

- ✅ example.com is allowed (correct) - ✅ api.example.com is allowed (correct) - ⚠️ maliciousexample.com is allowed (incorrect)

An attacker could register maliciousexample.com and proxy content through `terriajs-server`, bypassing proxy restrictions.

### Patches All versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.