Cloudflare Pingora security vulnerabilities

Cloudflare Pingora versions prior to 0.9.0 have security vulnerabilities. This vulnerability stems from the HTTP/1 upstream path of pingora-proxy, which does not remove the client’s Connection header, other hop headers, and the Connection header specified during the writing of downstream requests...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-57250

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

PT-2026-71105

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. Recommendations At the moment,...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...