CVE-2025-55152
CVE-2025-55152 · oak: ReDoS in x-forwarded-proto and x-forwarded-for headers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.
CVSS 5.3 · Medium · EPSS 0.4%
- Published
- Updated
Stack: node
Affected products and versions
oak
- Versions
- < 17.1.6: Affected
No fix published
@oakserver/oak npm
- Affected ranges
- SEMVER: ≤ 14.1.0
No fix published