31391 matches found
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...
mcpsnoop v0.12.0
Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...
Prototype Pollution
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...
GHSA-MMX7-HFXF-JPPX Axios: Prototype pollution gadgets can alter axios request construction
Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...
Axios: Prototype pollution gadgets can alter axios request construction
Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...
Permissive List of Allowed Inputs
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the isLoopback and isIPv4Loopback functions of lib/helpers/shouldBypassProxy.js, which require the first IPv4 octet t...
GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...
Permissive List of Allowed Inputs
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the isLoopback and isIPv4Loopback functions of lib/helpers/shouldBypassProxy.js, which require the first IPv4 octet to be 127 and...
NPM: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
NPM: Axios: NOPROXY bypass for 0.0.0.0 local addresses in axios vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0, 0.33.0...
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...
GHSA-94PJ-82F3-465W Guzzle: Proxy-Authorization headers can be sent to origin servers
Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...
Guzzle: Proxy-Authorization headers can be sent to origin servers
Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the handling of Proxy-Authorization headers by the cURL handlers and stream handler. An attacker can obtain proxy credentials by controlling the origin server and capturing the credentials sent...
BIT-NGINX-GATEWAY-2026-56434 NGINX ngx_http_ssi_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...
BIT-NGINX-2026-56434 NGINX ngx_http_ssi_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...
zaproxy vw2026-07-14
The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...
CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
DEBIAN-CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...