CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
625 vulnerabilities reference this CWE, most recent first.
GHSA-G2R7-8MG8-Q272
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'on_url' callback. An attacker can send an HTTP request to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2018-3907"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-24T00:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable vulnerability exists in the REST parser of video-core\u0027s HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, \u0027on_url\u0027 callback. An attacker can send an HTTP request to trigger this vulnerability.",
"id": "GHSA-g2r7-8mg8-q272",
"modified": "2022-05-13T01:01:59Z",
"published": "2022-05-13T01:01:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3907"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G2XC-35JW-C63P
Vulnerability from github – Published: 2019-12-20 23:04 – Updated: 2024-11-19 13:57Impact
Waitress would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.
According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked.
Requests sent with:
Transfer-Encoding: gzip, chunked
Would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message.
This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.
Patches
This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies.
Waitress will now return a 501 Not Implemented error if the Transfer-Encoding is not chunked or contains multiple elements. Waitress does not support any transfer codings such as gzip or deflate.
The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.
Workarounds
Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).
Issues/more security issues:
- open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "waitress"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16786"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2019-12-20T23:01:53Z",
"nvd_published_at": "2019-12-20T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nWaitress would parse the `Transfer-Encoding` header and only look for a single string value, if that value was not `chunked` it would fall through and use the `Content-Length` header instead.\n\nAccording to the HTTP standard `Transfer-Encoding` should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with `chunked`.\n\nRequests sent with:\n\n```\nTransfer-Encoding: gzip, chunked\n```\n\nWould incorrectly get ignored, and the request would use a `Content-Length` header instead to determine the body size of the HTTP message.\n\nThis could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.\n\n### Patches\n\nThis issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. \n\nWaitress will now return a 501 Not Implemented error if the `Transfer-Encoding` is not `chunked` or contains multiple elements. Waitress does not support any transfer codings such as `gzip` or `deflate`.\n\nThe Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don\u0026#39;t cause any changes in behavior.\n\n### Workarounds\n\nVarious reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn\u0026#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).\n\n### Issues/more security issues:\n\n* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)",
"id": "GHSA-g2xc-35jw-c63p",
"modified": "2024-11-19T13:57:29Z",
"published": "2019-12-20T23:04:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/security/advisories/GHSA-g2xc-35jw-c63p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16786"
},
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0720"
},
{
"type": "WEB",
"url": "https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes"
},
{
"type": "PACKAGE",
"url": "https://github.com/Pylons/waitress"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2019-137.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress"
}
GHSA-G33M-GFWR-29G4
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2022-09-08 00:00A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
{
"affected": [],
"aliases": [
"CVE-2019-0197"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-11T22:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.",
"id": "GHSA-g33m-gfwr-29g4",
"modified": "2022-09-08T00:00:32Z",
"published": "2022-05-24T16:47:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4113-1"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03950en_us"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K44591505"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190617-0002"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
},
{
"type": "WEB",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3935"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3933"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3932"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/04/02/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107665"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G4X3-MFPJ-F335
Vulnerability from github – Published: 2024-01-22 06:30 – Updated: 2024-01-29 22:29chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/albertito/chasquid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-52354"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-29T22:29:06Z",
"nvd_published_at": "2024-01-22T06:15:07Z",
"severity": "HIGH"
},
"details": "chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.",
"id": "GHSA-g4x3-mfpj-f335",
"modified": "2024-01-29T22:29:06Z",
"published": "2024-01-22T06:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52354"
},
{
"type": "WEB",
"url": "https://github.com/albertito/chasquid/issues/47"
},
{
"type": "WEB",
"url": "https://github.com/albertito/chasquid/commit/a996106eeebe81a292ecba838c7503cac7493e74"
},
{
"type": "WEB",
"url": "https://blitiri.com.ar/p/chasquid/relnotes/#113-2023-12-24"
},
{
"type": "PACKAGE",
"url": "https://github.com/albertito/chasquid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "chasquid HTTP Request/Response Smuggling vulnerability"
}
GHSA-G545-RMG6-689P
Vulnerability from github – Published: 2024-06-03 21:30 – Updated: 2024-11-12 21:30A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controller JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to takeover another user's account and read her/his chat messages.
{
"affected": [],
"aliases": [
"CVE-2023-51219"
],
"database_specific": {
"cwe_ids": [
"CWE-444",
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-03T20:15:08Z",
"severity": "MODERATE"
},
"details": "A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controller JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to takeover another user\u0027s account and read her/his chat messages.",
"id": "GHSA-g545-rmg6-689p",
"modified": "2024-11-12T21:30:49Z",
"published": "2024-06-03T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51219"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=40776880"
},
{
"type": "WEB",
"url": "https://stulle123.github.io/posts/kakaotalk-account-takeover"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G72C-CX82-64HQ
Vulnerability from github – Published: 2023-04-11 09:30 – Updated: 2024-04-04 03:23HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.
{
"affected": [],
"aliases": [
"CVE-2023-25950"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-11T09:15:00Z",
"severity": "HIGH"
},
"details": "HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user\u0027s request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.",
"id": "GHSA-g72c-cx82-64hq",
"modified": "2024-04-04T03:23:56Z",
"published": "2023-04-11T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25950"
},
{
"type": "WEB",
"url": "https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46"
},
{
"type": "WEB",
"url": "https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN38170084"
},
{
"type": "WEB",
"url": "https://www.haproxy.org"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G823-F2HP-HRJR
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-08-24 15:30An issue was discovered in Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via crafted content-length value mismatching the body length.
{
"affected": [],
"aliases": [
"CVE-2025-61258"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T18:15:56Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via crafted content-length value mismatching the body length.",
"id": "GHSA-g823-f2hp-hrjr",
"modified": "2026-08-24T15:30:30Z",
"published": "2025-12-09T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61258"
},
{
"type": "WEB",
"url": "https://balwurk.com"
},
{
"type": "WEB",
"url": "https://balwurk.github.io/CVE-2025-61258"
},
{
"type": "WEB",
"url": "https://ghostline.neocities.org/CVE-2025-61258"
},
{
"type": "WEB",
"url": "https://www.outsystems.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G8WJ-3CR3-6W7V
Vulnerability from github – Published: 2026-05-19 20:03 – Updated: 2026-07-08 17:35Summary
The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query.
Island components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of their props. This advisory does not treat that contract as a vulnerability. It treats the absence of a binding between the URL the cache keys on and the response served at that URL as one.
Impact
In applications where a CDN or reverse-proxy in front of the app caches /__nuxt_island/* keyed by path only (ignoring query) - a documented misconfiguration class, see GHSA-jvhm-gjrh-3h93 - an attacker can prime the cache for a path with their own choice of props, and subsequent users requesting the same path receive the attacker's rendered HTML rather than the response intended for them. The cache entry persists until normal expiry.
Where the affected island has any prop flowing into an unsafe HTML sink in application code (v-html, innerHTML, a third-party renderer treating a prop as HTML), this becomes stored XSS in the embedding page's origin until the cache entry expires. HttpOnly cookies remain out of reach but anything else in the origin (other cookies, in-origin requests, DOM state) is reachable by the injected script.
Preconditions:
experimental.componentIslandsenabled (or the default'auto'with at least one server / island component in the app).- A shared intermediary cache (CDN, reverse-proxy, edge cache) keyed on path only.
- For the XSS pivot specifically: an application-authored island that puts a prop through an unsafe HTML sink.
Without the second precondition, the response shape is per-request and unaffected. Without the third, the worst case is content-swap / inert HTML injection rather than script execution.
Patches
Patched in nuxt@4.4.6 and nuxt@3.21.6 by #35077. The island handler now recomputes the expected hashId from (name, props, context) using the same ohash function <NuxtIsland> already uses to embed the hash in the URL, and rejects requests (HTTP 400) whose URL-resident hash does not match. The response is now a pure function of the request path: a path-keyed shared cache returns the correct response to every requester for that path, and an attacker cannot synthesise a path whose hash matches arbitrary props.
Workarounds
For users unable to upgrade immediately:
- Ensure any intermediary cache keys
/__nuxt_island/*on the full query string, not on the path alone. This is the recommended configuration regardless. - Audit application-authored islands for props flowing into
v-html/innerHTML/ similar HTML sinks; treat island props as untrusted user input.
Note on island authentication
[!IMPORTANT] It's important to remember that route middleware does not run when rendering island components, and islands cannot rely on routing-layer auth. Applications gating sensitive data behind page middleware should enforce that auth inside the island's own data layer (server-only routes,
useRequestEvent+ manual session checks, etc.) rather than relying on the embedding page's middleware - this was true before this advisory and remains true after it.
A separate advisory addresses *.server.vue pages registered as page_<routeName> islands, where the documented "middleware doesn't run for islands" contract collides with the page's own definePageMeta({ middleware }) declaration in a way that constitutes a genuine bug rather than documented behaviour.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.21.5"
},
"package": {
"ecosystem": "npm",
"name": "nuxt"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.21.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.5"
},
"package": {
"ecosystem": "npm",
"name": "nuxt"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-alpha.1"
},
{
"fixed": "4.4.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.21.5"
},
"package": {
"ecosystem": "npm",
"name": "@nuxt/nitro-server"
},
"ranges": [
{
"events": [
{
"introduced": "3.20.0"
},
{
"fixed": "3.21.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.5"
},
"package": {
"ecosystem": "npm",
"name": "@nuxt/nitro-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.4.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46342"
],
"database_specific": {
"cwe_ids": [
"CWE-349",
"CWE-444",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-19T20:03:24Z",
"nvd_published_at": "2026-06-12T14:16:31Z",
"severity": "LOW"
},
"details": "### Summary\n\nThe `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any island component without verifying that the URL-resident hash (`\u003cName\u003e_\u003chashId\u003e.json`) was actually issued for those inputs by `\u003cNuxtIsland\u003e`. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query.\n\nIsland components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of their props. This advisory does **not** treat that contract as a vulnerability. It treats the absence of a binding between the URL the cache keys on and the response served at that URL as one.\n\n### Impact\n\nIn applications where a CDN or reverse-proxy in front of the app caches `/__nuxt_island/*` keyed by path only (ignoring query) - a documented misconfiguration class, see GHSA-jvhm-gjrh-3h93 - an attacker can prime the cache for a path with their own choice of props, and subsequent users requesting the same path receive the attacker\u0027s rendered HTML rather than the response intended for them. The cache entry persists until normal expiry.\n\nWhere the affected island has any prop flowing into an unsafe HTML sink in application code (`v-html`, `innerHTML`, a third-party renderer treating a prop as HTML), this becomes stored XSS in the embedding page\u0027s origin until the cache entry expires. `HttpOnly` cookies remain out of reach but anything else in the origin (other cookies, in-origin requests, DOM state) is reachable by the injected script.\n\nPreconditions:\n\n- `experimental.componentIslands` enabled (or the default `\u0027auto\u0027` with at least one server / island component in the app).\n- A shared intermediary cache (CDN, reverse-proxy, edge cache) keyed on path only.\n- For the XSS pivot specifically: an application-authored island that puts a prop through an unsafe HTML sink.\n\nWithout the second precondition, the response shape is per-request and unaffected. Without the third, the worst case is content-swap / inert HTML injection rather than script execution.\n\n### Patches\n\nPatched in `nuxt@4.4.6` and `nuxt@3.21.6` by [#35077](https://github.com/nuxt/nuxt/pull/35077). The island handler now recomputes the expected `hashId` from `(name, props, context)` using the same `ohash` function `\u003cNuxtIsland\u003e` already uses to embed the hash in the URL, and rejects requests (HTTP 400) whose URL-resident hash does not match. The response is now a pure function of the request path: a path-keyed shared cache returns the correct response to every requester for that path, and an attacker cannot synthesise a path whose hash matches arbitrary props.\n\n### Workarounds\n\nFor users unable to upgrade immediately:\n\n- Ensure any intermediary cache keys `/__nuxt_island/*` on the full query string, not on the path alone. This is the recommended configuration regardless.\n- Audit application-authored islands for props flowing into `v-html` / `innerHTML` / similar HTML sinks; treat island props as untrusted user input.\n\n### Note on island authentication\n\n\u003e [!IMPORTANT]\n\u003e It\u0027s important to remember that route middleware does not run when rendering island components, and islands cannot rely on routing-layer auth. Applications gating sensitive data behind page middleware should enforce that auth inside the island\u0027s own data layer (server-only routes, `useRequestEvent` + manual session checks, etc.) rather than relying on the embedding page\u0027s middleware - this was true before this advisory and remains true after it.\n\nA separate advisory addresses `*.server.vue` *pages* registered as `page_\u003crouteName\u003e` islands, where the documented \"middleware doesn\u0027t run for islands\" contract collides with the page\u0027s own `definePageMeta({ middleware })` declaration in a way that constitutes a genuine bug rather than documented behaviour.",
"id": "GHSA-g8wj-3cr3-6w7v",
"modified": "2026-07-08T17:35:09Z",
"published": "2026-05-19T20:03:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46342"
},
{
"type": "WEB",
"url": "https://github.com/nuxt/nuxt/pull/35077"
},
{
"type": "PACKAGE",
"url": "https://github.com/nuxt/nuxt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning"
}
GHSA-G9PC-8G42-G6VQ
Vulnerability from github – Published: 2025-04-08 21:31 – Updated: 2026-05-13 16:22The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "spiral/roadrunner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-22871"
],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-24T20:57:40Z",
"nvd_published_at": "2025-04-08T20:15:20Z",
"severity": "CRITICAL"
},
"details": "The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.",
"id": "GHSA-g9pc-8g42-g6vq",
"modified": "2026-05-13T16:22:16Z",
"published": "2025-04-08T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22871"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/issues/2166"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-783943.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/roadrunner-server/roadrunner"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0"
},
{
"type": "WEB",
"url": "https://go.dev/cl/652998"
},
{
"type": "WEB",
"url": "https://go.dev/issue/71988"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3563"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/04/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency"
}
GHSA-GCX2-GVJ7-PXV3
Vulnerability from github – Published: 2022-03-22 19:22 – Updated: 2024-10-01 19:30Impact
In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.
Unless you use mitmproxy to protect an HTTP/1 service, no action is required.
Patches
The vulnerability has been fixed in mitmproxy 8.0.0 and above.
Acknowledgements
We thank Zeyu Zhang (@zeyu2001) for responsibly disclosing this vulnerability to the mitmproxy team.
Timeline
- 2022-03-15: Received initial report.
- 2022-03-15: Verified report and confirmed receipt.
- 2022-03-16: Shared patch with researcher.
- 2022-03-16: Received confirmation that patch is working.
- 2022-03-19: Published patched release and advisory.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mitmproxy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24766"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-22T19:22:59Z",
"nvd_published_at": "2022-03-21T19:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nIn mitmproxy 7.0.4 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response\u0027s HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request\u0027s body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.\n\nUnless you use mitmproxy to protect an HTTP/1 service, no action is required.\n\n\n### Patches\n\nThe vulnerability has been fixed in mitmproxy 8.0.0 and above.\n\n\n### Acknowledgements\n\nWe thank Zeyu Zhang (@zeyu2001) for responsibly disclosing this vulnerability to the mitmproxy team.\n\n\n### Timeline\n\n- **2022-03-15**: Received initial report.\n- **2022-03-15**: Verified report and confirmed receipt.\n- **2022-03-16**: Shared patch with researcher.\n- **2022-03-16**: Received confirmation that patch is working.\n- **2022-03-19**: Published patched release and advisory.",
"id": "GHSA-gcx2-gvj7-pxv3",
"modified": "2024-10-01T19:30:26Z",
"published": "2022-03-22T19:22:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24766"
},
{
"type": "WEB",
"url": "https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b"
},
{
"type": "PACKAGE",
"url": "https://github.com/mitmproxy/mitmproxy"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/mitmproxy/PYSEC-2022-170.yaml"
},
{
"type": "WEB",
"url": "https://mitmproxy.org/posts/releases/mitmproxy8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Insufficient Protection against HTTP Request Smuggling in mitmproxy"
}
Mitigation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Use only SSL communication.
Mitigation
Terminate the client session after each request.
Mitigation
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.