PT-2026-26779

Name of the Vulnerable Software and Affected Versions Ory Oathkeeper affected versions not specified Description Ory Oathkeeper, when deployed behind components like CDNs or reverse proxies, may incorrectly evaluate rules due to improper handling of the X-Forwarded-Proto header. The configuration...

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Summary In impacted versions of Astro using on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences the most important of which are: - Middleware-based protected route bypass only via...

EUVD-2025-175298

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass...

EUVD-2018-11829

Malware in sbrugna...

CVE-2025-55152 oak: ReDoS in x-forwarded-proto and x-forwarded-for headers

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers...

CVE-2025-55152 oak: ReDoS in x-forwarded-proto and x-forwarded-for headers

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers...

CVE-2024-21499

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS...

Koa 安全漏洞

Koa is an open source middleware for Koa.js. A security vulnerability exists in Koa that stems from the use of malicious regular expressions to parse X-Forwarded-Proto and X-Forwarded-HostHTTP headers...

PT-2025-7056

Name of the Vulnerable Software and Affected Versions: Koa versions prior to 0.21.2 Koa versions prior to 1.7.1 Koa versions prior to 2.15.4 Koa versions prior to 3.0.0-alpha.3 Description: The issue concerns a Denial-of-Service attack due to Koa using an evil regex to parse the X-Forwarded-Proto...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from vulnerability to HTTP header injection attacks via the X-Forwarded-Proto header...

GHSA-2C9M-W27F-53RM Apache Tomcat vulnerable to Unprotected Transport of Credentials

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

PT-2023-21918

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M2 Apache Tomcat versions 10.1.0-M1 through 10.1.5 Apache Tomcat versions 9.0.0-M1 through 9.0.71 Apache Tomcat versions 8.5.0 through 8.5.85 Description When using the RemoteIpFilter with reques...