CVE-2025-55152 oak: ReDoS in x-forwarded-proto and x-forwarded-for headers
MediumCVSS 5.3
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oakserver @oakserver/oak(npm) | <= 14.1.0 | No fix listed |
| oakserver @oakserver/oak | = < 17.1.6 | No fix listed |
References
- https://github.com/oakserver/oak/security/advisories/GHSA-r3v7-pc4g-7xp9 vendor-advisory
- nvd.nist.gov third-party-advisory
- https://github.com/oakserver/oak/commit/b60e60330ef227707c4dc13ef0ea36192d894f44 patch
- github.com
- github.com