Server-side Request Forgery (SSRF)

Overview @portkey-ai/gateway is an A fast AI gateway by Portkey Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the x-portkey-custom-host request header, which allows user-supplied values to determine the destination baseURL in the proxy route. An attacker...

CVE-2025-66405 Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch...