https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:58:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-10300 EUVD-2026-10300 https://cve.radiocsirt.org/vuln/euvd-2026-10300 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49800 <p>`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.</p> <p>`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-49800 https://cve.radiocsirt.org/vuln/ghsa-q6hx-3m4p-749h <p><strong>Affected:</strong> npm: nuxt-api-party</p> <p>### Summary `nuxt-api-party` allows developers to proxy requests to an API without exposing credentials to the client. [`ofetch`](https://github.com/unjs/ofetch) is used to send the requests.</p> <p>The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow.</p> <p>### Details `fetchOptions` [are obtained directly from the request body](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L27). These are then [passed directly into `ofetch` ](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L57C15-L57C15).</p> <p>We can construct a URL we know will not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively.</p> <p>### PoC POC using Node.</p> <p>```js await fetch(&#34;http://localhost:3000/api/__api_party/MyEndpoint&#34;, { method: &#34;POST&#34;, body: JSON.stringify({ path: &#34;x:x&#34;, retry: 9999999 }), headers: { &#34;Content-Type&#34;: &#34;application/json&#34; } }) ```</p> <p>We can use `__proto__` as a substitute for the endpoint if it is not known.</p> <p>```js await fetch(&#34;http://localhost:3000/api/__api_party/__proto__&#34;, { method: &#34;POST&#34;, body: JSON.stringify({ path: &#34;x:x&#34;, retry: 9999999 }), headers: { &#34;Content-Type&#34;: &#34;application/json&#34; } }) `…</p> <p><strong>Affected:</strong> npm: nuxt-api-party</p> <p>### Summary `nuxt-api-party` allows developers to proxy requests to an API without exposing credentials to the client. [`ofetch`](https://github.com/unjs/ofetch) is used to send the requests.</p> <p>The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow.</p> <p>### Details `fetchOptions` [are obtained directly from the request body](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L27). These are then [passed directly into `ofetch` ](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L57C15-L57C15).</p> <p>We can construct a URL we know will not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively.</p> <p>### PoC POC using Node.</p> <p>```js await fetch(&#34;http://localhost:3000/api/__api_party/MyEndpoint&#34;, { method: &#34;POST&#34;, body: JSON.stringify({ path: &#34;x:x&#34;, retry: 9999999 }), headers: { &#34;Content-Type&#34;: &#34;application/json&#34; } }) ```</p> <p>We can use `__proto__` as a substitute for the endpoint if it is not known.</p> <p>```js await fetch(&#34;http://localhost:3000/api/__api_party/__proto__&#34;, { method: &#34;POST&#34;, body: JSON.stringify({ path: &#34;x:x&#34;, retry: 9999999 }), headers: { &#34;Content-Type&#34;: &#34;application/json&#34; } }) `…</p> https://cve.radiocsirt.org/vuln/ghsa-q6hx-3m4p-749h https://cve.radiocsirt.org/vuln/gsd-2023-49800 gsd-2023-49800 https://cve.radiocsirt.org/vuln/gsd-2023-49800